0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:27 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x2800000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:27 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) mkdir(&(0x7f0000000000)='./file0\x00', 0x20) 13:11:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1637.313766][T21943] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:27 executing program 5: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) mkdir(0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffff401870cc, &(0x7f0000000080)) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x240000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000003840)={&(0x7f0000000040)=@un=@abs, 0x80, 0x0}, 0x0) 13:11:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1637.397947][T21950] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = dup2(r0, r0) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f00000001c0)={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x29}}, {0x6, @remote}, 0x46, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x14}}, 'eql\x00'}) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x141000) r4 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') sendmsg$TEAM_CMD_NOOP(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10080000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r4, 0x71c, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x4004010) 13:11:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:28 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:28 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 5: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) mkdir(0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffff401870cc, &(0x7f0000000080)) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x240000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000003840)={&(0x7f0000000040)=@un=@abs, 0x80, 0x0}, 0x0) 13:11:28 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="18647f9d1752459cb090a4608a909d06aac1394bf23af93d170694663cb8a6a006e5bba89919d69b039a7ac97a73db7df44dc675c3b6f84284a8c3257fc4bd", @ANYRESHEX=r1, @ANYBLOB]) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x200000) ioctl$IMSETDEVNAME(r2, 0x80184947, &(0x7f00000000c0)={0xc37, 'syz0\x00'}) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 13:11:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1637.851557][T21985] binder: BINDER_SET_CONTEXT_MGR already set 13:11:28 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1637.919546][T21985] binder: 21983:21985 ioctl 4018620d 200000c0 returned -16 13:11:28 executing program 5: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) mkdir(0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffff401870cc, &(0x7f0000000080)) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x240000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000003840)={&(0x7f0000000040)=@un=@abs, 0x80, 0x0}, 0x0) 13:11:28 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x5800000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1638.003295][T21992] 9pnet: Insufficient options for proto=fd 13:11:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1638.093733][T22001] 9pnet: Insufficient options for proto=fd 13:11:28 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7472616e733d66642c7266646e6f3d889718ba7771e93cf649f96aec4070c6b771265b4ed23f713573443dcb447500a24bfa5e897fd8b0fd2b864f773cc50fb15474eabfb1f9bf755acd28a4719a88ea222c6468bc82d0dbf0461ae62483e9a6aa3adeef66feecce9424ee32dc1d2287a221665974b61d86acd9126bbd844a944bf3893566611fc40800d12d2877d30eef1190075468b78fa4d51179b1073c05", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="0200"]) 13:11:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:28 executing program 5: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/mISDNtimer\x00', 0x0, 0x0) dup3(r0, r1, 0x0) [ 1638.402631][T22023] 9pnet: Insufficient options for proto=fd 13:11:28 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:28 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1638.453277][T22030] 9pnet: Insufficient options for proto=fd 13:11:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:29 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x594c8908f540403a, 0x0) ioctl$TIOCGSERIAL(r2, 0x541e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/38}) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="83fc"]) 13:11:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:29 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7d9288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r1 = accept$alg(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000006dc0)=[{{&(0x7f0000001340)=@pppol2tpv3in6, 0x80, &(0x7f0000006fc0)=[{0x0}, {&(0x7f0000001500)=""/169, 0xa9}], 0x2}}, {{0x0, 0x0, &(0x7f0000003280)=[{0x0}, {0x0}], 0x2}}, {{0x0, 0x0, 0x0}}], 0x3, 0x0, 0x0) [ 1638.711378][T22041] binder: BINDER_SET_CONTEXT_MGR already set [ 1638.717519][T22041] binder: 22037:22041 ioctl 4018620d 200000c0 returned -16 13:11:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1638.759096][T22052] 9pnet: Insufficient options for proto=fd [ 1638.853401][T22060] 9pnet: Insufficient options for proto=fd 13:11:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:29 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:29 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:29 executing program 3: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x20000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000140)={0xbf, 0xf4, 0x1ff, 'queue0\x00', 0x91cd}) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) r3 = socket$rds(0x15, 0x5, 0x0) signalfd(r3, &(0x7f00000000c0)={0xaa59}, 0x8) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x40800, 0x0) write$input_event(r4, &(0x7f0000000040)={{}, 0x15, 0x40, 0x80000001}, 0x18) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="7472f34817b41ef700126e6f3d", @ANYRESHEX=r1, @ANYBLOB="2c778eee4f1366840ff58ec6355174c9d24000d27085646e6f3d275cf566889865bfaea1e7f45780d95e688a29a77c45ed116a493d655a243d3c8a935ab404540bafbf99f2d214783f7edaefa3ec460026b81834190a81eff2bd6fd0e9f65fc16f483ae932cb561ab565c8a787b08e8d22a7946a2f16ef4c97001bd28215166c3f4ef75d81acade2e95fbee1d353065ee85079dcda71401736f85c3d31d6ed25ad647ef45e905db1375ea1b9f4a5a27f080728b71c009a75706f7e9c1a2c76f61b8750984b304c323be8f30603abb39c9ec45415b516fe545fd0614b785623a99fc358782bd938cd39d7080c084ad62a6ad374f6197b5fbdccda7d59fd69de8ba8f7503316d16d0d4ecd6a2f314392c0c9b97ed66aae0b417501fc04a457fa6b8b58a841a3a10af3c9a8efc411173e70accd6d43cfbd9f6e1ade9d923bf6e7d1dfa40ae72aff2d82a57a7e38eefab6ea9e8859d10147d3a2c92280096987c8da7e8d8dc09e759e96823ca77baa56bb3cc41e982c76dfbe6599d5b028629c12b92572837ea6dc3cd62d4c331d53727b1da113a9501f7c7249e10d37bbc2423923f08214c2cf774fccedb02c2c640ef03e40c4543de70bfcda72b5493bd8bebbb3bceaee9a53067bc274dfad885dd4faf84926013a1cc1912a5fc26ff5bf39eebdd3e8fd441c1be4b210caaa46ac29045bb8339330ffebe5b40153f78333dedbac97ce52d2ad010927844ac233c8120a038404cfaedcbbbfabd13e2e05344cf9b6c4608a1b8f2e267c51cca45738bcbba9abac24027236a8cdeca64565c10f032919dcb9c563d4193451", @ANYRESHEX=r2, @ANYBLOB=',\x00']) 13:11:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1639.213104][T22081] Unknown ioctl -1064545482 13:11:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1639.273643][T22089] binder: BINDER_SET_CONTEXT_MGR already set [ 1639.283709][T22081] 9pnet_virtio: no channels available for device /dev/ubi_ctrl [ 1639.294288][T22089] binder: 22075:22089 ioctl 4018620d 200000c0 returned -16 13:11:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1639.334163][T22086] ERROR: Domain ' /sbin/init /etc/init.d/rc /sbin/startpar /etc/init.d/ssh /sbin/start-stop-daemon /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.5 proc:/self/fd/5' not defined. [ 1639.350435][T22081] Unknown ioctl -1064545482 13:11:29 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:30 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r0, &(0x7f0000000400)=[{&(0x7f00000000c0)=""/139, 0x8b}, {&(0x7f0000000000)=""/63, 0x3f}, {&(0x7f0000000040)=""/4, 0x4}, {&(0x7f0000000180)=""/185, 0xb9}, {&(0x7f00000002c0)=""/5, 0x5}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f0000000380)=""/81, 0x51}], 0x7) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f4f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1639.737035][T22128] binder: BINDER_SET_CONTEXT_MGR already set [ 1639.786870][T22128] binder: 22112:22128 ioctl 4018620d 200000c0 returned -16 13:11:32 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:32 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f00000000c0)=""/180) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="7472616e01d6733d66642c7266646e6f9e", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 13:11:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:32 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1642.243247][T22157] validate_nla: 19 callbacks suppressed [ 1642.243258][T22157] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1642.290619][T22156] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:32 executing program 3: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) write$P9_RMKNOD(r0, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x22, 0x2, 0x7}}, 0x14) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c77666c6e6f3db2fa030004759ccf6a8c8d3d1dbb6127015c090000003779ac77840acf1858c944e0e672cfbd85635557fe5d7570c613dfd2b745d8b1adbdc3230e17497d280957e4d531fa5511e2547102867d60253283fe3892289770fda6bca0184e5129ff0000000000000002cb5684d00eb860363fea49c614303e486594733397e0eedf717500000000000000", @ANYRESHEX=r2, @ANYBLOB=',\x00']) 13:11:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:32 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0xffffffff00000000, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1642.575345][T22180] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1642.613628][T22182] 9pnet: Insufficient options for proto=fd [ 1642.617988][T22188] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:33 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1642.661194][T22190] binder: BINDER_SET_CONTEXT_MGR already set [ 1642.674997][T22193] 9pnet: Insufficient options for proto=fd [ 1642.678581][T22190] binder: 22183:22190 ioctl 4018620d 200000c0 returned -16 13:11:33 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:33 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="a4c7663d0000009e140e423a888e8e73fad9833b", @ANYRESHEX=r1, @ANYBLOB=',\x00']) [ 1642.833910][T22199] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1642.873903][T22202] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1642.938178][T22208] 9pnet: Insufficient options for proto=fd [ 1642.971799][T22209] binder: BINDER_SET_CONTEXT_MGR already set [ 1642.992903][T22214] 9pnet: Insufficient options for proto=fd [ 1643.004646][T22209] binder: 22205:22209 ioctl 4018620d 200000c0 returned -16 13:11:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:35 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c003064eb893344a6e50b26f310e8070144cf9de96b47b9587aed49e7c536f19a43ecd82b1e13a2b5e06a18e3869d72199088d4324e097008138dcf636223efd2298ac177680ad0381ba5355c9c88e4c016ae5765d9d8a4e061062f13a88ffa1205dee1b3d5647753"]) 13:11:35 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:35 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1645.341293][T22229] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1645.379434][T22228] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:35 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) r2 = syz_open_dev$vcsa(&(0x7f0000002540)='/dev/vcsa#\x00', 0xfffffffffffff528, 0x200400) ioctl$sock_rose_SIOCDELRT(r2, 0x890c, &(0x7f0000002580)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x732f, @null, @netrom={'nr', 0x0}, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @bcast, @default]}) r3 = socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="1c7766646e6f3c", @ANYRESHEX=r1, @ANYBLOB="2c00f052afa289f3615d37c9a03424f68dc3aef78534bf26edc16142312a62ca583c914105c6281521ddd1107e6635db"]) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f00000001c0)=0xe8) sendmsg$sock(r3, &(0x7f0000000640)={&(0x7f00000002c0)=@hci={0x1f, r4, 0x3}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000340)="b7d0df54419541a95c26d0862c89c6891993fca9cf873aba30bf8b4b2d0cc170ffa35f76b42068059777827d786ee4956ee4e7e74ab916a42b62e72c2f0917d05cf0075f781f684170bb7bf32afdf6f45efefadd9ec4b4f9e3a9f7216e10b01e666d8c70053efed933d6e714b97ecb82cd843f306c4a80f1de68aa2a018c1e1d7f4ae6532366b394401998356dbcb77cda5b8fc414879996d01d71cc4780d2e50e68b1a4427fe0229c62769cd4fb5edeb11885bd289981b8", 0xb8}, {&(0x7f0000000200)="f9e855bde316807a6455c9ac", 0xc}, {&(0x7f00000004c0)="900f27b9d6b558cf1eb83c7b5cbbc09d13d225173bfc9a6b2b543b764440e57476202c3b176e6a21d9eafef8ef67b98f011f69ed4425b6da5bb7efcb48c43b7a89cd01f0f43c5c9831e584543ed0a36e2cae68e05f2b006c6835e9ec8b22f612588e9d765561fe33be86daac25fac28e3fa0d43a010d5dab2a89cbbd9d58c880db", 0x81}, {&(0x7f0000000400)="be6131510c6b1d2343fbe95f6e0813f77671a3b59667b0de6d1fd2fa220117888b836f24c27599208daf4680100d92ba797dd2d4e118d59bfc255fa5223c2574293fbbd8dd41b3d877e9aa90c8e9560bfbdbc58e68563337c6002cca5faeef7aeafa8b7e6d7eac73c952fc666cda29d4e9f54e441b89", 0x76}], 0x4, &(0x7f00000005c0)=[@txtime={{0x18, 0x1, 0x3d, 0x2}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x48}, 0x810) 13:11:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1645.496842][T22240] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1645.641109][T22251] 9pnet: Insufficient options for proto=fd [ 1645.655299][T22255] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1645.755746][T22259] 9pnet: Insufficient options for proto=fd 13:11:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:36 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x0, 0xc7, 0x401, 0x9, 0x5b4fedb5, 0xffffffffffffffff}) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:36 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000fff000/0x1000)=nil) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r0) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="2c7766646e6f3dfd81232c145ee4a84f4ae413d81576eb8ffbf38c60e7088e6a615702706e265c6353131f76e2d15735b57cf020a34d70649934071457cbe72a663ba02e763111a64d005ecc5e65efea989ede5e464f0dd8f98a27ce9b779602262426c9fd887b764fe862b9bb2bd1ec40288847d151463d44862fc23856601b19e8a42683f2e74dff59dabf6b071ae830a9a923eccebfa098516817ee73bdaa4cfd7a8d7487d395a1f311ec49fa4c7764aafed7c2fd8d2805f7bd1390feaac4db17a4c5e9eff65a1b6be5a388f0c0c35120ff1da9669b880db530aae3a6a948ab2155eab50d21643ca6149aa039b8207f2d276a736cb7a54212f26a6b7f14b435affa36e03afc7fe8d4fcf87a7561200f7280a13fca7238cd455b7eaf969d6f70db8fff47614b02863071d2779fa2c115d77ea92754657ccc4fd255b42c5630dd8b0f63f72aa23f2e6f0d4d694e7af20581fc6dd547527a0c8eb137ece3c66339f7bde5547624bbfce8b26669d2c37d84ad938c4386e86f4408a86368", @ANYRESHEX=r1, @ANYBLOB=',\x00']) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000040)=0x1) 13:11:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1646.318932][T22309] binder: BINDER_SET_CONTEXT_MGR already set [ 1646.339281][T22309] binder: 22296:22309 ioctl 4018620d 200000c0 returned -16 13:11:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1646.367225][T22313] 9pnet: Insufficient options for proto=fd 13:11:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) [ 1646.444272][T22313] 9pnet: Insufficient options for proto=fd 13:11:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:37 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4003) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/tcp6\x00') ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000040)=""/1) close(r0) socket$rds(0x15, 0x5, 0x0) 13:11:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1646.651926][T22335] binder: BINDER_SET_CONTEXT_MGR already set 13:11:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1646.751617][T22335] binder: 22325:22335 ioctl 4018620d 200000c0 returned -16 13:11:37 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111, 0x13eb646be36a6be8}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x2, r1, 0x0, 0x1, @in6={0xa, 0x4e21, 0x0, @empty, 0xa514}}}, 0xa0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0xfffffffffffffffc) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000380)={0x7, 0x1, {0x57, 0x5, 0xff, {0x1, 0x400}, {0x0, 0x7}, @period={0x5a, 0x87, 0x100000000, 0x7, 0x1ff, {0x2, 0x10000, 0x25b000000, 0x3}, 0x1, &(0x7f0000000300)=[0x2]}}, {0x52, 0x9, 0x1000, {0x8, 0x3}, {0x7, 0x58}, @period={0x40508e03c987f19c, 0x100000000, 0x6, 0x1, 0x4, {0x100000000, 0x1f, 0x200, 0x7}, 0xa, &(0x7f0000000340)=[0x1, 0x8, 0x80000000, 0x6, 0x1, 0x3, 0x401, 0x7e53, 0xf2, 0x5]}}}) readlink(&(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)=""/42, 0x2a) close(r3) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB="2c7766646e6f3d59014ec58c0ae01118aac446e25d542c9447e19a408b9a0c92d2fa6e71c5881eac55dc02a2f8bd94cdb236b45612625f9b82836a1bcb0fa0b7", @ANYRESHEX=r3, @ANYBLOB='l\x00']) 13:11:37 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1646.984061][T22366] 9pnet: Insufficient options for proto=fd 13:11:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:37 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x24) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:40 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) 13:11:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:40 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:40 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x480) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000040), 0x4) close(r0) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 1649.606113][T22394] validate_nla: 12 callbacks suppressed [ 1649.606126][T22394] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1649.638386][T22397] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1649.707470][T22402] binder: BINDER_SET_CONTEXT_MGR already set [ 1649.732497][T22402] binder: 22389:22402 ioctl 4018620d 200000c0 returned -16 [ 1649.780850][T22411] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:40 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000040)=0x101) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 13:11:40 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1649.936016][T22421] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1650.097970][T22433] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:43 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) 13:11:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:43 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000040)={'vlan0\x00', 0x380000}) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x58, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1652.712069][T22446] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1652.750453][T22447] binder: BINDER_SET_CONTEXT_MGR already set 13:11:43 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x6, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x800) r1 = getpgrp(0x0) fcntl$lock(r0, 0x6, &(0x7f00000000c0)={0x1, 0x2, 0x8000, 0x4, r1}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x3fffffffe) ioctl$KVM_SMI(r2, 0xaeb7) close(r3) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c00b173fbd4152c241b161b60c253947e781c27050fae60d5d522fb957965f6e649c1dd5a0dad4cdaea5856213871109100a5eec0a9855776e6bf49ce5bd4317d50672208947232533fdf9ba0e4d40a707c40ce2a8491ff42debc0e4a78630600000000000000d2360579e15b1c3f44feb36d25ec3d2ddc930b6709a386ebc0681543602be5d6e7c568fc1c31a2d2"]) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) [ 1652.765195][T22447] binder: 22442:22447 ioctl 4018620d 200000c0 returned -16 [ 1652.772423][T22450] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:43 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1652.934496][T22464] 9pnet: Insufficient options for proto=fd [ 1652.987257][T22473] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1653.002593][T22464] 9pnet: Insufficient options for proto=fd [ 1653.024456][T22471] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:43 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x292600, 0x0) mknodat(r2, &(0x7f0000000040)='./file0\x00', 0x2, 0x4c3fd87b) 13:11:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1653.212890][T22484] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1653.231093][T22479] binder: BINDER_SET_CONTEXT_MGR already set [ 1653.237131][T22479] binder: 22477:22479 ioctl 4018620d 200000c0 returned -16 13:11:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:43 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="e3901d53c022151c75e56dce427ce47eeeed6e31df7c0e1935d43e2ee601dc855e3a3603cfa84050f6c0954b247262ea6e599053891ae3e11acec4", @ANYRESHEX=r1, @ANYBLOB=',\x00']) 13:11:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f5f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:44 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1653.687921][T22519] 9pnet: Insufficient options for proto=fd 13:11:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1653.729082][T22529] 9pnet: Insufficient options for proto=fd 13:11:44 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x35) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="93130500000001aca7a8b167d7dfa1798bb91ae80830ec2d4844a36d9a68f70a41b644404cbb42ee85be1209c5cf581704c5b60e0eb98326d137c5dbaa86362eb2baa905e70c89d4ebb00559a525797657ea2ff8dc"]) 13:11:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1653.959404][T22545] 9pnet: Insufficient options for proto=fd 13:11:44 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1654.028059][T22559] binder: BINDER_SET_CONTEXT_MGR already set [ 1654.034101][T22559] binder: 22546:22559 ioctl 4018620d 200000c0 returned -16 [ 1654.043629][T22561] 9pnet: Insufficient options for proto=fd 13:11:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:44 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:45 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1654.519673][T22588] binder: BINDER_SET_CONTEXT_MGR already set [ 1654.585966][T22588] binder: 22587:22588 ioctl 4018620d 200000c0 returned -16 13:11:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:45 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:45 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000000c0)=""/86) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 13:11:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1654.795298][T22619] validate_nla: 12 callbacks suppressed [ 1654.795309][T22619] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1654.835254][T22622] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1654.964690][T22633] binder: BINDER_SET_CONTEXT_MGR already set 13:11:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:45 executing program 3: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) getpeername$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000040)=0x1c) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x2000000, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) [ 1655.020524][T22640] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1655.021742][T22633] binder: 22621:22633 ioctl 4018620d 200000c0 returned -16 13:11:45 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2800, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1655.156717][T22647] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1655.198526][T22649] 9pnet: Insufficient options for proto=fd [ 1655.260369][T22653] 9pnet: Insufficient options for proto=fd [ 1655.364087][T22655] binder: BINDER_SET_CONTEXT_MGR already set [ 1655.389267][T22655] binder: 22654:22655 ioctl 4018620d 200000c0 returned -16 13:11:48 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:48 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="7472616e73e565642c7266646e6f3d", @ANYRESHEX=r0, @ANYBLOB="2ca83611a1bcd20000006ace6664603486cbfabbb7000000004cbe1e357e138f83ebb9c91f71b1b3c99d7ae8c08da17a1ea22c1a007b", @ANYRESHEX=r1, @ANYBLOB=',\x00']) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x10000, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000040)=0x54) 13:11:48 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1657.669919][T22665] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1657.707307][T22675] 9pnet_virtio: no channels available for device /dev/hwrng 13:11:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1657.709194][T22670] binder: BINDER_SET_CONTEXT_MGR already set [ 1657.718819][T22669] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1657.756753][T22670] binder: 22667:22670 ioctl 4018620d 200000c0 returned -16 13:11:48 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x5800, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:48 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x10010000000006) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1657.912496][T22686] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1658.038386][T22694] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1658.081245][T22691] binder: BINDER_SET_CONTEXT_MGR already set [ 1658.158061][T22708] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1658.168661][T22691] binder: 22688:22691 ioctl 4018620d 200000c0 returned -16 13:11:48 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:48 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1658.328451][T22713] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:49 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:49 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='ns=fd,rfo=\x00\x00', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) [ 1658.553132][T22728] binder: BINDER_SET_CONTEXT_MGR already set 13:11:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1658.614004][T22728] binder: 22721:22728 ioctl 4018620d 200000c0 returned -16 13:11:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:49 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:49 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @dev}, &(0x7f00000000c0)=0x10, 0x80000) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000140)=0x4) pipe2$9p(&(0x7f0000000000), 0x4000) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000180)=@gcm_256={{0x307}, "d53e4e897b0cea71", "5a4c9aef32c5f123b6c1bb858e1a88e5c1dfab259da587301f525b13ace1a30a", "4d512803", "2d91b6d29c0512c5"}, 0x38) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="cffe607890195afbd0e59ecf2ea95ab7e44dd58cdda419ec5cee954538f732858a"]) [ 1658.866205][T22755] binder: BINDER_SET_CONTEXT_MGR already set [ 1658.899552][T22755] binder: 22747:22755 ioctl 4018620d 200000c0 returned -16 [ 1658.955572][T22759] 9pnet: Could not find request transport: fno=0x0000000000000005 [ 1658.983261][T22762] 9pnet: Could not find request transport: fno=0x0000000000000005 13:11:51 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:51 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:51 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2c080, 0x0) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1661.341830][T22770] validate_nla: 4 callbacks suppressed [ 1661.341847][T22770] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1661.374405][T22774] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:51 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:52 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x400) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xffffffffffffffe1, 0x440000) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000140)=0x0) accept4$packet(r2, &(0x7f0000001900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001940)=0x14, 0x80000) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000001980)={@local, r4}, 0x14) tkill(r3, 0x3c) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f0000000040), &(0x7f00000000c0)=0x18) 13:11:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1661.677286][T22796] binder: BINDER_SET_CONTEXT_MGR already set [ 1661.685859][T22793] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1661.705371][T22796] binder: 22786:22796 ioctl 4018620d 200000c0 returned -16 [ 1661.719464][T22800] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:52 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1661.758922][T22804] 9pnet: Insufficient options for proto=fd [ 1661.774370][T22806] 9pnet: Insufficient options for proto=fd [ 1661.881582][T22810] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:54 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:54 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:54 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x110) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:54 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1664.448147][T22824] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:11:55 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000180)) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x400000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @multicast2, @loopback}, &(0x7f0000000100)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000140)={@rand_addr="bfdcafaee5835584b56a30b529fa4c08", 0x1, r4}) 13:11:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xf, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1664.497111][T22822] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1664.523022][T22823] binder: BINDER_SET_CONTEXT_MGR already set 13:11:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1664.572469][T22823] binder: 22815:22823 ioctl 4018620d 200000c0 returned -16 13:11:55 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1664.726670][T22849] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:55 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = dup(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 13:11:55 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x10, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:55 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1665.042939][T22872] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:55 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200, 0x0) ioctl$CAPI_NCCI_GETUNIT(r2, 0x80044327, &(0x7f0000000040)=0x7) close(r0) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='transfdno=\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB=',wfo\x00\x00\x00', @ANYRESHEX=r1, @ANYBLOB=',\x00']) 13:11:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x5a, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xc0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1665.320383][T22894] 9pnet_virtio: no channels available for device /dev/zero 13:11:55 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1665.392007][T22901] 9pnet_virtio: no channels available for device /dev/zero [ 1665.403570][T22902] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:55 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:56 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="2c7746aa6e7f3d", @ANYRESHEX=r1, @ANYBLOB=',\x00']) 13:11:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xec0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f6f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x33fe0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1665.742543][T22925] 9pnet: Insufficient options for proto=fd [ 1665.780737][T22937] 9pnet: Insufficient options for proto=fd 13:11:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:56 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:56 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) accept$netrom(r0, 0x0, &(0x7f0000000000)) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 13:11:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1666.098568][T22953] binder: BINDER_SET_CONTEXT_MGR already set [ 1666.124129][T22953] binder: 22951:22953 ioctl 4018620d 200000c0 returned -16 13:11:59 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x20000088, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x24000) r2 = socket$rds(0x15, 0x5, 0x0) r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r3, 0xc038563c, &(0x7f0000000180)={0x0, 0x0, {0x5, 0x1, 0x0, 0x20}}) ioctl$VIDIOC_S_FREQUENCY(r3, 0x402c5639, &(0x7f00000001c0)={0x71, 0x0, 0x5}) ioctl$int_in(r2, 0x5452, &(0x7f0000000040)=0x100000001) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mixer\x00', 0x2000, 0x0) connect$rxrpc(r4, &(0x7f0000000240)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e23, @multicast1}}, 0x24) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="aa701338523c5b481b2c28f4005af86915f574b5f80c9af0ee7472616e738b2aa24b4640743a877798ca1de83e92905e7e5cdec2449972850ab387eb", @ANYRESHEX=r0, @ANYBLOB="0704e9036dc700", @ANYRESHEX=r1, @ANYBLOB=',\x00']) r5 = open_tree(r4, &(0x7f0000002680)='./file0\x00', 0x88001) fcntl$setsig(r5, 0xa, 0x2) sendmmsg$nfc_llcp(r4, &(0x7f0000003ac0)=[{&(0x7f00000002c0)={0x27, 0x0, 0x1, 0x5, 0xfd5e, 0x0, "b7e8e49500b7c98c1c44513e6eb15ea5f79c1e45c7ce5d03b4b4546316200c5d70400aaeab01f23e04108927c5efc39260d3fd1b10f23e388e712a1dc70abf", 0x3c}, 0x60, &(0x7f00000004c0)=[{&(0x7f0000000340)="531f06a8ec4138d513d52202a77c693c2b6b90e4b8daa2e72382c434fef1bf0d84c24cbd6220295120f52873ded9f7894e8e4d2220b42c2bf22565793bea88c75a6948f16dff46d7c1360fddbed14e96d9865d3e76102dca672bb87d0df3b8cf537351d106c83ac9631e1daec16cdfc044d9", 0x72}, {&(0x7f00000003c0)="de9713d61669746cf60cc3e1d0c371f01ca4d1e27a0f234754b928849bfbf9c54f481aea4c775cf5bdb56f27a7cece9032d45596ef9e84635353edbf2851b50e4d0b2d77a5420a8bc30dd6b8f1eb093ed8ca1db956b1685855d3ca3edb788d5417a7dedc6c1f3365a488a028d6d704e9091dafd418296a35c02d8841931ec2f5a950a5fd9a574b3a78e9d416fd47", 0x8e}], 0x2, &(0x7f0000000500)={0x108, 0x104, 0x2, "6c80bbd1dd59e5478a54013cc9225da0e57e32a04f14c93b65cd8a6ec904a8397937a54edfb5d8b26e88d07cd3ebb8784b7c93011538c68d3b4d6dc88665e0435f19882773d22770e5f8df07b451db6040bb28ed470e8f6cf20bb56d7d931256393b560f73808b6fd28926c4dfd56bd711bea1f17266efadae3fc2115437aef94219bb8c7e863f238b66687c7f6765d003b67121934a4a53c5ce944a909a474764497b012d73bc84cf197d79ea9986e2f7b144f767a5ec88a68af89818e033f90bc753a423e4836e30d16d506267ceca3141ccceb1eacdbf1b2d533f2c594b53d9fcb359a6a70c1f8138958e4492352e3381f9d3"}, 0x108, 0x10}, {&(0x7f0000000640)={0x27, 0x0, 0x1, 0x5, 0x4, 0x3cf4, "407dd7b103fc9f3efdc054d3ea11ce7caccd1532603e2669e04089d5ce7f7b0fb5625ce2951386531fcdda94f30f75e10e814be8b5b2398fd060146045f9cd", 0x1b}, 0x60, &(0x7f0000000700)=[{&(0x7f00000006c0)="54158d79a17c84d264bdfda2cdd6a0b4c1f37e4f37beaf62605f4cee14921a1bd8a065288b8f2137c09c83047dec8686fb", 0x31}], 0x1, &(0x7f0000000740)={0x20, 0x10a, 0x8000, "5a781e2cfa4cc79d8eff"}, 0x20, 0x4000}, {&(0x7f0000000780)={0x27, 0x0, 0x2, 0x0, 0x3, 0x80000001, "98171514002740124c7d73aabb87f3b5dcc8c7773a16d90679ca9b211601c300a4822737dae07417283313a7e5881bf2aa4b8997ab4508a0d193139187213f", 0x2f}, 0x60, &(0x7f0000000c80)=[{&(0x7f0000000800)="876ba1f7fd71b6aaa8caec9ce26abe4292a62160522cd27642e6c97183be2af8e7e28d42baa2d1", 0x27}, {&(0x7f0000000840)="e9d97acb19d25af0da46b7ac11ce74359115524995a5c1ee76b768718416e8b6a89fb54735962467fcb3c3cf0c77cd9b3b4efedf84567e4ab5fe090a0cdd57a5880f3d9170523af036fbdef4606127da1f56684669eb8d6bd2815149c4f7d7a55c6b7fda5551c9349e796f90cb84ddee774d83d39a77dfdaf4c73b6cc6304c5da20e8074f7177093831724442efd008da333c35e8ef599bb7e18597978179e55388c8ea98ecbe4d97abf3e64d6701312caffe56e500a65e3697a4a3e02d1f5e3bca9faf29112cd9a8add395fea12f1751f52d00039e9", 0xd6}, {&(0x7f0000000940)="92e9931fbeb609ae07a58762f58e5535d339ca3f6895758a08ca35a9ea9bddfafb5c0585791d4e064aaa194d6e8a1c10c0c4b4755aa266b11205cbd31f966e599def9e2812cd7e31eb51c768a7f2e621a9929a8bfaebdeb936f1d8a67614fc1900af620d0a37226f2560cd5b3124937d163c3073ed1de07a568eb8a025b496d2cb0f65487f2f016e1365de", 0x8b}, {&(0x7f0000000a00)="d95488338ad89457ec06a2654cdb5fad97783ce697499d84c620cc63104d3cf464ac5885380f9307ed126301fec32ed51ff5e477703342901ba97bd429861984baf23eb5dd7df60324db33da2b21e80a1e8ce29d7b32357b6d8ae92cdfba18a8f3e38031060bd40531da09dc32", 0x6d}, {&(0x7f0000000a80)="d3ff2d1ac4f9880876f9bbcf7162466e4a86487f81aa34d3b731ee1af204d69f4add2888169207dfcf8c640e4300440cb2dfbdfc0188acb0f82e7a61d24d611570a52bb36e00fff14eacb9b3d65fe6b01e9099188a70ae52a5524afee4efef1394de1f1a494433c5d87a9ca0b01b381c365c6b2c81d950f10093f3e48ac64313b1d637b80e749fc306baf422a88bfb168fdc8a782034bcb5c117c05dfa84e865e391bdf9b7a0c14a008bbbea9be300c7aa4a3c0bf30e1639bf151eabe767cb", 0xbf}, {&(0x7f0000000b40)="b6629115673890fd50f57151fd1e0c1bd4d9d7d25a1daf7112c13d151485563c438779d4549c608f5a0d2f7deb1ca998fc7268001023f3bb0dbcc6579af29cbb1eedf8375832a73f5a7ed349fd4c42eb247148c2fa16aba9bd195d66fb01ec63dfc1f8", 0x63}, {&(0x7f0000000bc0)="0b44bf98a9bde8af1a091c8d5e87a519aace71d25f4e6628762d29fbfed27e906ca1296df2e51afb9f4dde8b9d81f17411a07cbaecc0d32d3cb0792c374927b801acf8d161d97e45486717e959b1d9a94fe044d2499ab7161631b971b1faf79ef74b3e0c31f8505f23729aec2e6917067419bfc0f5c7226a702dcc28a033023be6ac6888c5a277ce87", 0x89}], 0x7, &(0x7f0000000d00)={0x28, 0x119, 0x8001, "f8fce0aaf99f19fd4639a9e475ec07188c"}, 0x28, 0x40}, {&(0x7f0000000d40)={0x27, 0x1, 0x1, 0x1, 0x0, 0x67, "df70cd600e2c40a203f5a7e98e2a8295e57e94bb0584d644bf1e1e09034bff9ff54057fc8b3e45450b405941021f1d42276294a58b5215bf267ee7a076eab6", 0xb}, 0x60, &(0x7f0000000ec0)=[{&(0x7f0000000dc0)="ebb991c8073cfca798c0940213a393fa508d77f7590bf65f2f06d3d7af6b", 0x1e}, {&(0x7f0000000e00)="faaca4eefbcc67a3852689676ecd6fed1c332f1eb38530fbd76c1cdfe9f0c7ead53779c92271ef2d7c6091a935b3ef88d28ea769f5d32dbaf95eabefcd72ac1059920ec0044f2508ec2d5b66b22ecc961fdc7840fa094556994f86", 0x5b}, {&(0x7f0000000e80)="aa4c78b4b50baca6a66d9cb8786419a0d62dafca2d2e584cd67b7869ef46cc9cc8ffb24a2c3d343b79ae5b76423901a709", 0x31}], 0x3}, {&(0x7f0000000f00)={0x27, 0x1, 0x2, 0x7, 0x6, 0x7, "55d4ccd1f071a2d23e44eb626a0685d48af5625558d26d63c4ce439500b2aa3f212b3817003a67ffa90286d1e8bbfcb5fc41f337b29392948bfdfdc04c4d68", 0x5}, 0x60, &(0x7f0000002000)=[{&(0x7f0000000f80)="ceb04fc1a8276994152ae457675e067fefc5f451a5f7f8e7d91f3eb0657f3c35112ce7cd5318341c829347289420f62823a88870a8bee793d23ffe4eb522793c77a7864ed739b61d961ecf2b8c78ef1891f7df9ff5738dad0ee3dac28adda26c062ee8b956f309b5f173367d9fc007875486030b26f6f9fd73c490001f7562c8445e7220c867e0435f11bd88756f08e6910ba8faf703a94fb0cf28a718737cb652c167fefcb6fc1dc33da4f17e7019f46fdcd5e573eca0a2f2a3ee5ddaf9c05d6349f37ea182e6367ec6700a6fe80be828604f711f11338eb6023c2e50a0ab77b5cf9e9749b1d3120362512192695c35c55dc2d1707fa3d620630412a1bfd42e00f26735dc932743561dcc2a151da7fbb5edce59c5f42709895581e1e3a5a44b8a301e3653c5143b0e3bb3e33cb895fc5c8f1387443dcf28479b508618318e5b684194410270c523907ad7bee2b8361dcf72f813c5ce93c214f54ed6fe64275a8e0f52d94b9a61887a768760e913451039761c05ec8611bc3a216f0ee9bc9ff0771b70d9439fbf1c6f63f20d61b01e987b33e645af6fd0d6178dccb7e6215ed6593e1b018d05c3ae9fd5d814d473d92fe41f5787db75f6f62708933d400418a7251a284d9a28f74d4999118a16525ddafd3a76a348ceb13e825541e8735e2fd884f16002bb4b4f68ca2fb198a593d9ad1ebe043328f747448e54adc0009f2cd082e62e37a38ae5236cf98b7134faeca18cee82f21f3267f314478f6ffd5461935e1ff4542e4fea8a5fe128ee45a773e7e18be2c97675f04d520e761ae3e5ba1cce444a103d407fc25ffa2fe21aa32e8b1bb48ffde6b0e2655cff8a6f8f9aae04ce1f34a03b2f62a8ecf84db63505e3171f8361f8d144813ba7b926ede02548563d21436f1d20a29350814a042fdfe5c399ff8c18982b33925b6eb1a72fdbed963f0182bd7f668d67f5e6b8592fd539efcd38dd11741ab3d1927a9862f276e0e05ecdd8ae7ae42ae76a5e8532fe478c6c2d29264f4493266b12d99a3000791ba239705b3e0a291210503fddb7577c45c1e32ceb5705659b0037f2d6ca0b22492c6e86bd00e924150a8133452c311a939cac57cba223432cd8c65b57656bf55750ea806c24750568e6ba8551fe58083c89f4ae90136662dda08d9b10798ef01e29b780232c7a4a87f4afa4300883401b7f799116ba8fe1169f25630dd1a1efd22f7d83ea6c900ef3388329299f8c369663f29c79f9946238ebfe6eda305bd9516e473ebab4bde57f8f765b9d63a57522a4e550a987aded49e92fa0086235bd3b4d052e418e895e4ec40d332d945f65f8bc093815478b1228a25d44bcb7bd572fc7ff201229abd6a32e4719da817537871a567ad2c5348ba16509d96d6fef9e3803879e026aee04b096ce04e6fbe11e1196d61fb60aaeda00299d1df7c4d8b6539effff2d785dc8143bd60f06ab3ee5512e4bc60d9876e01b3d121571853049c1b9b6d4a565ca1b917572d8e56db8c9d0558a6023b5f32644eb3cfc6dc55c88e1c07b54b04c5fb6cba7cf3f34b60c689e3ce7bbb34b24c18f16485d6430a8b0109e65a8c8b94574058399b1d541cb8d905f1d00760a9ff8020780129926f3edcaf582e6f1a7497fed97cd265c1fd7cfc132fa29083029ae33d29eed7681495f91f1e93060e6c82db0a8e45e82230664495701952b283e6bc3abc397a2bc2e0d6ac6dc3dd95077eeba159baafaf1bca16e4f4b6019e36d2d114be76e07baa7be8ec43b99eaf0e6d71ff1e753de9c4ed461d20314b79a9522960c0480ac16d7ceb5519858dd35703c42f6105676269911a620d7dd11a293109aa6b56e72f9211ec5b0fc2475887da1c7869b984870cdbcb5efe3dd23eaf9f186a34f0c08e5e7d36b09c5e69f2ddf0537952a19b3c542a249c5ec67acb5b2fab6039aa60940d856940dc3a4bb9d7039cb114a8d89964a3c4cbcf5314aecfd724dccdef016413722dd7bdf8a25eb1007dfbc8cd211f22f3077bea313fa580a261f7a33de9feb0ff5f878b31d56827bb1a3e276cef6fac164de0b82ffebf0c8decdd60cf1302412d894c7daec01bb3731a446d5ec362ff3c5715d6355376eb2b0d9b88375db56cb0e0fb58e0515d6c9edbc88a785d2ac30ca637415e42198dd2fc14f92efb5135a8a21670045a240f9e4e6a33f31140c7ccf8bbe89ada0694899de9f3acc0e337dc9d9a541e906bd79373fe2c090f0e731a9391b2acee9aa141e06d1600807370e06c03d8de54712eeaa8755a73608ea04f86a41297cf04e08df2fd4b321dd8c7c954048c51ae0097ec6358c13a15147252a85e0d3d13d327d8c76de26bb13badf0cf503919b9615088ee8bfa4c35ecf0a077768dc0240181254f31bb8fa986e7a11f0f313545f590ed5ceefb96894ab53ae32df3367697a440ac8ec40dbff9eaad10244b34bb93065cd616687e132fbb2a337b1c851f7a0b4393924596f132a1dbdbaf34455fd80ed9f48a7dfdf94b2258d410ade96363f85fcbf5a761d061b0bc1bb4ca476cbe9c58ed7a5ae1412bc78a4e123fc2b6ee1acbc8fa93ae2ee4319e79667fb63fd175702ae794a35becbd5eb1924055acd73ea8b822651c84b98a6bf6d74b515becf813410ee243ea5560b70d8c4524480dc3585b68bd5544cdfb8b94a039906b2618a4ad53f2b2948779e22b51825d6bd731a196debfb859a7366eada81054959bad3451211776e2be07795fbd8e0b48590068e3137ccaca945a375103d4f7c2f1f1e49ea1e346cc0da10c3d7dd5abf091154c4d86996c3a86d01e8bbf584ef05dab3101c137ac9714adaf68ef875fe38b6a2b29940569d226a1e901f163ced3c07a893f5c6f76a61425a957c5e073ead07a70c1a7c867ecba4a81d06f4273519b2f029df35296c17c880eacc3e4c8f6693c89264e496de3925940c6bbc10fde7a513500365967111e1088a44fabd33d1b0c731bb31ef258b8ad9e5a1a72a1a319760a71329ac23747b6309338359d7ad9cff4383a2ddda5100e12dd7d809f58579c11c29f6bdea60c9af4377d4b0396ffafa69e9100c395dc64177c7f7012c9437ab59fc2e7bec6dcc1d9f05054feef36ed9da16721a7ea63ae737d389be28c7743a8de3d96ed496ad3e0eb639b93fca37ff4d1e9d4012f83c6f500c9cf83ac888d88951ec0ae80bcd9887c98fc6c12282662aef42ce8d845156d0f91f940c1340448b723e04b56d2c7195f8fb187c054e5c9baeaec08fd8dc544b888fb26697bcdd76fcd4e41a2a1f52dbfd3a5c91af5ebcb9151f10280ac199832f808a05c0cb6129f8ebc5c9d9ebc9cbbe330d079e9bde4c755cd4a99b2f9fc37e884fbab3be5010d89a1184d8b1171aef803e6159b79320028947b23f803c1f56d8f924c0722ad7e831b7f096caa4c251d30477d6313650c564d8ab2d7ab045ab7337ae51c7fda9e33445cb0432b25a9ccd51cfa07ec22d804df6c685138b8b14bb1a0ebe75a2e9c83bb1bfd5b2aabffb25cd3f05fdf9f119b92dbbb44f66881150406ca15582d48d49c78889965e25683273b6aee3a145754c71a55c72b77308ced8207bf5c8793c66b1fa6efbe652a9dad41a9d19cf76c23eeaadfa11a282d34777489b239846bae31a8069e89f2b28e34ebc78eb80b6df92978c882c080ed18129616b636fd9cc8fe98173e5b8277ca57ec2bb637efb694f89e833f77be8e2fa204a0e472fd4126cc636ecf6c41c2185c6fdc25bcb6a8c5e18dd2881ce1d0e17b558134ae073552bf65e7bbf6b095ea3675fb888058ebb7f0ff0152ad6107f62d1ec1de98239b65cd5ea8d3605f44068a6085f19f8b8dbd25ad155dd175302c7e883660126d6572c716b41e81dbf0e6d92c7abbdb8258ca61502c0b6df8297051a53b9c61922e8d7a38e846393de5dc289b0669bbf6ce59a83244eca0d261c6a5e07ed5a3c9e73f038de717912bd7858bdcb8e54d0dfec56e558345532badb68039b8ed7a7b2503112815b391f58bc8d8742809a71b6e4faf512bdd939abc8211d17455175d2a2ea7aa35a21b3d19d97434ce4d28d5e1c9b1d6dd3c9b5b24710b2910200eef0396d04f615a58d74e3fb7626996ae3dd82d3fc9f1240414cacd4ec5eb99fd1c73f707942fc7b5ccc576aa864b6d004f5936654002014429b89e8a9282b19b2fe7a8048e9dcdef694438d696f88fb36f8968b0571192dfa837c8f235ac7b029d053ed5632826df707d34128423afa2128609edfb0ec7e0774980792533ad594a0574496abcd647931569c7df184ef17df86c083d10834a93e519571db776345a2a02b6587570025aaf46e3afe86af87bceb6ab7bef2fd04267993667c41313e991a9d16ba0adf152ee0a9a7099988c9c06c7eecc7d1c2c130a8fcf92897026fff00ac827ea91cffa2de3bd7ccfae796ea1f138fd7151194bba076b8be42ac4bc9c4ce958c68b91c5f8d1b2b4fabd177b12e241bff08b72860bc5b43114a31b19dc09d536687b26c6a2ffb9165493a56b15ad6fd026e04892d4d81cc14c825a9d1857de8c7e5d83cbf4008aa648ba9141c4d03697ce057c7d98e64d778b7b7d048645cc2f268de491c09438de6b6921ab62f6bca7fb4518b061f88993b8d1a6e765356fd5a705787661700674adb3f644f206734acd6a374f99327889ada0729ce3b5cab10080d29e9a7f89dd0f56f1c2075fafcbb656f532771ddf2a1ffac86dfe85dd5f9a60fbd13940b5a1139f957ca3f2fa0d771ea62ac33fbfc61cfb2aab198100c702a64a01ff332ad5fc4566e549a83d0d149b7431c0d3c43c42637850adb57f2015027cf0d135e424613128b3720aa26cae19b74f7c790b7b9275384c7e241a576382710e4ed439dc3acbce79697b5af113fc15e348b4d12d6b6bf0cf89cd57a572322d626c591cdb0e65584c56ca2ebbb919b8a84d0f29aad6579994d8a52fa7e226dcbabd4048b70e39a95521b61fcd433a92bf5f0f5a14686885a5a26a9aec6fa111de271c8ed500c911001dca7571d6fb3f3114ec02892648e3ddfd06950118bcd38b886fc97109610ffbf5940cec53e0291a679cb5365801e406f0dcc2d7f285d7727699a1f2c9c20d4e67ec80ec177ae83561a265e95e7ce9aae0fd6db6d3beb1bb849b0ec8150e79131721be214a5d3a3f2b4640e24c309f90e7fff0a28d26e61378a483ac974aef371749215e4ff554e48a07ada837852aca6d4376530aaf6c954a16e995041f014f145ce087738fa58b9e1e66c35c51bbce7421a34582d3e643c70631a0dbd4da92b0c2cac9069b8dd779c7e4f0f5c321f4993022f5474adfa179ffb42457fdc2ac771a55202364ace87061716d6a2943855ef6fc783879f145bf0815beb81dc39b43024ab1dcb843f6b643ddcb576b563957fc46f3cf6ac723319f925b33b78aa8be23ae5306852a6c71d5e754ec76659641c1b3236a3881e9ae906b209f79bd46fdbd74be1d0b36396b002d6ac470a97283c7b227e19ff149b5681713ad54c1eba154382b211b0e4afe0d14ac7897ab5cc8e1e2beb21cebc4bea52350393df296e097cbb70982696d3147ce93a76fa8edcce4a8bbcf3bc68e354fb8c137ccf1debd6740ed61a0da3fd4f9ecf6902eca2ac01523f32dcd91a4beb8e46318c3470566a13ec7d0f705a7178b328414442578583fe2dfcb839c5f1d5dfc46322e8693ff3bacd10efe9a5c2a856b5699904a40d08171c8b2a462fbccba4dbc3928a2bcf0b9f810745e5d4a0a9035811aa8dd5d589ab7bcf40a2ab04fc32edc30bfa7bcf386a7f00d880304226b3", 0x1000}, {&(0x7f0000001f80)="d5c634deddb9089e34fd7bcca8cf58e95cb875c518f066e0cf7e0f908b4d389152f5fb198a9e46f3ee96d45e9d", 0x2d}, {&(0x7f0000001fc0)="570c73d0939991310c10635b7e14d5c9122bee2365540d8049686bab77e2e0d788390f0d5de36aeeb27435173eb7b522d34e373b37fbe4cd0f4dff6d34a9", 0x3e}], 0x3, &(0x7f0000002040)={0xc8, 0x117, 0x45d22b88, "9073e2177d2cc2b2e24ac236c5edad3b202051931e14c7e466e4067fcbceaffab3093a8542f056753cbeeb71a8e5b9b37d9def38b4cc1799e22d510682656baf623db5ce8f3e7758ea7707b93d463042a6f65aadf5eadb118e548582ff11a338d9a1de4e716eea40f8ae46a9214403c311155e54b9e101353be5871d1948824c424af52a440fd267bef4add398cf3d68f92667589c38da30e0ef526dbb0493e27e71ed21b2a8e58d9c7705f42a6f91eb76ce15"}, 0xc8, 0x4000}, {&(0x7f0000002140)={0x27, 0x0, 0x2, 0x0, 0xb37f, 0x74b1, "bd60271085c921c6aa4631ec552b409387f20c4d5d3cc947af51f743290f8719cc9730a5fd0243e0f090f1731d88c75b25027f1269047bee65c000d2937044", 0x2d}, 0x60, &(0x7f00000023c0)=[{&(0x7f00000021c0)="0760ad32f3cf88b2c2cbb620e4fd46e964f44c6c11e5d4e48144bc62a3edf3987d158216a356d6e9baead661f7c3df0cd2ba65b3852f0485abb78ce500aca8e3fc59f73c1a436a2d9fcdeba0e96965d54fa4dc81d6bd081ea11b9af72c045658b6d93ddf2f32f31e4c0fee2747af65335f6a37c99f78aedd52954126f2d2922b0c65a54ff6bc0a36812987a96ea510fb18f1be476695e15dda94", 0x9a}, {&(0x7f0000002280)="fd205ceaa190d19c94e80c7637552e00fe5ec4137125f6b83fa9106de666de030c602414a97debe21135f15ea2dc2e9879af07ffa6b26d1ca67356711cdde88902d90147f35cb3adce0cba2e05039b55251f489d6544b021588c3113e26ee81851b778ebeff5f9c452e53c6312901da1d9da31d4166d0a165dbd3b26f8e3f4d89a1f1a379b2f8368f5b3e33281b1f00c29483e798aba5f22a6c14efc3df489f16ba5f68afe7c1895cff13a4a9965c80521fd3c021120dba3ff49eaf96e7ce553f3a4eb173ffb52bd95a979c687d44e74c9f48e0c82f1d6c25c84faa0b27a9e89856534c29de190b417", 0xe9}, {&(0x7f0000002380)="99c683cce92c4020f641b6de4b418c3693ccbf820f845f6d86dbfe", 0x1b}], 0x3, &(0x7f0000002400)={0x28, 0x103, 0x4, "cba3c60d811b0526bebaa1704af4890823438db5ad"}, 0x28, 0x80}, {&(0x7f0000002440)={0x27, 0x0, 0x1, 0x7, 0x2, 0xffff, "c95f5718a4086e13215b18993e132a183eef1fbdc035299e8381b09630723e3fef1b689f2b17fa18ff9082b20d4de8dbb2e34b200c1e2942ad9d9d50ca8884", 0x1f}, 0x60, &(0x7f0000003980)=[{&(0x7f00000024c0)="348de3882f83f5d1fcb93ab2961281bb48a9406066416f77572ba6c81e6ec17d88c9981ff0585dcbaebc049caf4414aa2bb10cb6af8f61e299dc09df64ab0c3891792bbe83ea783b686172a48f99942c99463ee476137261689137ee285166bfb99c2c1fa87ec73075cd289918335cfa4979e1592133b529e8e5d3044a08b2bc48337da61916c49cda57124d52abd2f8009f681414e50251d67e53f3", 0x9c}, {&(0x7f0000002580)="05638b3f11ea6316a16a55801e679d7a6ad608e6cb350ca465bd057fc178eff2d5ebf186fd555496c67fb302469840afb543250f756958183d4ee3d1315b2056c32ac00417d81c43fc7b8db4d494e6fa11c57411b02a17742b925220b2d1975e5311f4c2e6666dbeaf16893309bb145885a8efbce98ccbd81af144579ff74733d94779bc23cf4e5ac12fd01795be17331363c52cabb00df937a6e0901b0ab95a716867d80599a467fc02b413a50fe71402eb75abac7074f6a184a7dafc5eefbc3aeee7437bd80005de065e1c366b40e635b1f4e7c5847183e82db2cf3abaf3d65b44", 0xe2}, {&(0x7f0000002680)}, {&(0x7f00000026c0)="a9ced3fd12ff9cc54766c1fa057b678b8e906963943f296d2f7dfa401a8fb26e87b60a41f1d4d0a2f986cba6d9d86e2f00ceaa7677601d7bc5ab623e7997f58eb4ea1d73059d772f07b17770a496edd89522f4c9cee95f4d30d1494bcd2f0ac96331d7ecf575e8d503b0a769413ba8f46d70344f015842b2cc75672174e6e9c37e92630cc83f", 0x86}, {&(0x7f0000002780)="ff7a76a39430cc16c7bb92a21cdc6f711ee602e601cbbbf7d8b17a813d7ac8e46f78ecfa63bf69c3605ae711adbea7b6c67012158763f14458b2feb95db757f8c232f05d3a46e1f0e818127450c683498fcffddb306546f25bbe5a700edfaa04e32f48a9bd48785c09ac273aa52cbe6eff4a14d71de23c32a4324f7f7ece9e020d50ea22de38ea2085d7b261be0cd557c1927f7eeff3a3f3ef020df32dd3560676bbdeb72e0214d718edf86a423a8f5b96b2ea4e579f9ea5cef6448eaabd18c53e8dbc60ac4d1e7799bd21bd0e4f34773a2f1d89bb5a89b3ec34421c79bc574dd0395e60b2315b9fe185ca2ce357ee388eef", 0xf2}, {&(0x7f0000002880)="524a5ec3f053b69ed2ad88d45b3356808a4f8184112584b731e78de38677ccf72bf64cc9c9012be2cb92b3962d5c6c3f190809dbaae3d5a1943df3a5748fc516a6bbe551152f7cf7a8cf6c2ad8213c2dfb8e84977865d051bc0b69ed841956caf8f5f87a1c22cd88a94b2c384bb88aa708803737b25e51b842b8f27ea05217f81809a72c2142e551d84021332cf5c5e51619e212344e5939d8400769e55683c74634ecd5997cc148d20ec0cd6d3feff3e594279ac9fe6be2ea0e44eeb937b6b733e01a36342464ab2870414f7d786ec0db87cc579e31ff8280185cfab1dc936732f6ec4b96d0215ad4979a39353499f146e91a1d50c98145e7ebd4481054ed1221b812a923769ffd8551750435c991c2d45218093968b3d41a9859eb13d4ca4b0f3e399ff717c2fbe7389804532b0ebacfc019409398ea8a2ffc64fce1fa8b76087d3ae1c79f58be7797ed9a0fb5cb6d0b132b1aa01687bfa97544d44b4c0726f17a21e7a341a4e1f2ae0be36427ae86970ebdb30cbe3faaf81a69123b32b955620059e9b1349bcc8127286a6a9bb5d662dc6a021433f0a4f98e079246427c28d75b729411eeac1191d10239594290caa9361c05e70ecc88cc1b9d90ca496f5539d8efe6f53a0d4b8deef2733663f5ff3090eac75d6ec9906997708b63559550fc0d2cfea71dafcd218226ade4d4bbcb52537cc4fdf78f2d2f2b582db9b3238c953ad81c2b43f7549cee619026c782f026f9d1ffa28db9d98ce0e727ee842130607a200f4dc81271ece0d6e6a77381186a86d8f7c1b52512305f73c721dde6694383ad4d83af11a7e27dcc9d5a41adbdd2a85fbfacf482b0acb026dd53635a1db869d71c6d56b5596c3249a007a2cc917572ff320c27f9d5c88092915b301ed97de4d887b537a00b3dabb0966fa771d35e6cdc03cd87d6300974cc9cfa2fb25c92472d7f31902a987366b9dfb3826f78b75bf2ebfae140681cfabe8753b00d88bfa1b03827b59775d3f854e94855f078d5710fa24446f350037f6c92c64d5c0e08d8bd0b0a43c0a2d18bcb9c81293bac6adf20604c0057880e28ec0b03689b02ff3e281640bf40613bf0f9c56ca9a60821bcd4a21b9626e162e0dc1bc8dd7fb6d0412f06240738e14ace2f659f5d44fcb82cd2be404d4a938949da88c33bdab30e57d16ec8e20ff9a9cb98a8fcbacf2d525da0fd1604f5f992b6c5ddf24854ce75e45282354bf1070121b45ca6e4252f6fd0731084212bd0f2c51d5d74d2eedcd0af11f649cf23e00e6184e6bd69eaee9a96256b1fa0c1d007a1a89291fa1e7950984da4a325454dc8f70fdb52c59dbd70bd61ce96b94fd40eb83a042bbba960f2d843962c9ec3331727de23af0137a5977c54bdf767608f8f3c0b8f1b02aa53782e5ac1d6e01274772cead72d7c24beea73dad13efae7b931d91e11defd511208dd74314ff811e8591161454e933244391b4410240c480c7dd980c40fdbfee0e010a3cadd29e1b4cf5454127ebddcb046bb098d74ee97a179ba5993ba35ad400ae42b79dcf01a6b16b0f6bf5c7f062d078b1bcf6557103f2501f8525b1f4764672a7acc410d5991e7f347eca475387bc747e4f50fee257ee8e949a3e0c81586a990e0c1d9979218b0c8acc5d0f5ea5863a8a6d2ab6fe154408129a5c4a3d22e7247e4a81b3047a34dd43f02d43eb7f022af57f99825d6f2fdeed5623face2552647dacf254b13bc07585842a7f84d1ed3f10a50bd25748cb3a9b93954cddab48a700309f498729d3b40d37a368dd508c054322749ad101ce944c9e506dfd8b60618f20c6269935b20eab8d1944d76086efbc86e128f612de21898b5f55c1cf2e5e9546cc5bb821b05d2c2c919ff53d351f0b3e710d07ae5333ce71b60dacce58803c713d13590692d4557dabcf6e218202a4578793378299302bbf927f881056c30a15b8fa5b94b301ec764fb022868203ccd956368efbc72c30f0fc9242c09bdf74d09fc48d06f4d184ee90024c4cdb27b4f200e232a1c618a516f01aba9f9af35176eb5bb688a1fd929256093d1248c1345fbad102ad95a13b1314b280d2dd574328d448a2dd814b24b7c4764db52259a585ff0501b058225b5cd1495d41ecee4e8541fe10682ed379076a33fbc744bafdb22a9b668793ee3d26475540626a10df8d54d8efad913f8201caaa39d497468e688c6b23ea1135aefe48d3dae69e0b191f40cd6c27855c03b47b62d02b36f3aa74cd3264a11581161decbc453cc02abb28ac82345f1121e1314978599b65863d5060db9efc2424b5735d80e08eaf5945b94718b1bd23af5470a8d5a3cba21b040c568d7b23725b0e2d63ff9e20979c406aabf451cbe10c6d68dcda6d472c4c684c2f794ea4a2aa6ab091fae65cfb2def52c10298f40cc5849adef07d8b184cb047cc6c5fa8e8c172b8545a8f7384f06df860906a111cda2ff56a784a4d574b969427c6a0915c15d552b445deb85e3055b31f68268cbce2eea85c3ffed37c674b794c30035460317dd541a756d2ebc2f58f753f05ab64d7ee6a7a32d4529d6f80791fb2380f8c8e95b5fc88df8c3904f370bd4d96e45f96c9d96dcda5c815aeb014f1a806275220ffa901591e18c2372439be445c386522c8c986ba1cc132134d3fb37d93f2e36dc0319f4703c9fcf4a70376fa1140facfb1deb834e1776e6be026e24d2b9feead3ab3d67a94d22a4761d0681eaf3b809e87afbd693cd33f92cac177b392a4ffbf8e23668998b5d768cda55f787fd178f818168ff01c685f9f7566e5f89522242885271a5700c44e1262694227f112aac537b26876d1018741c9c42eef8c213d4dcb1c97ad38d61ccc1c2658a4dd9562d0f475550092a9e0133266955209fc9561f9eeb306df89d6cdde36d4f2c8b54202c3c3ee7eb9af941012b05077ecab5caffb032d0b15a1a9d08854c1c28fb94aa1365a3c4a4df1d5ee9ae285befdef06aae3ab22bb1f82a6643402030210250adb2869dcfd1062d3cff95ed524dbf026a259101ed72c86e211a0a218932b2532757f8aebd91b9b108b5d336eaad42286a9cdfaa2932b7f82877b20f44e74a0fbf261a626a6a5dbc5c4bc2f02cccfc4bca6ac746bf2a5fcfdfacb7743ac02b3d6e0e0d7abb0250e4c04c92e80ee6494062e6b75a7707ecbc19548cc7fa7b5b8d188a93dfcce22b2df522ec8f6cd5b637db8e2abb1f697689dc7ac75b870ab7d3daab6a7f704f4652285183b9f9749704fdd9196603b5d8dc7cf65f3693e4616b21a0cd8df3091f7d68715aaa334aba186c4bb181e6de24e9002187340ca98f9857ca5557b67486ced4074a02b6253ebdf2003ea900af2ac323b91aa5abc4bbad1f5534feb119e9bf9f1ed70421666806678a06a1133c00c35d95f7e9dead040c8050cc342f339b9f6628ab05440a2a7a3d83b6c13bb5554a0040c1a70f58f33c950832bc8485b312e329c6cd90a65d6d1eb9b630f34cf6812fa0e7a736f0524e77560332e78c3e8004b3a7ee4e7aef6119712801eaf7a11f2f3084028923f6f63b7fd23aa98e7ed27a1cc3b099b37a4560c3c8fa891904d0a312286d79608ebf1f558a014fec9d70b688924294b25ab2cbbde1d319fcacbddf03a77a41f78b27857f421868ca3bd1d4d265bfbfe506a3f3731273feff4d00a48f067d294475676ce77139eff6f698069c63762ccebd64740993d02b44d65390976cd54f907b6ccd3a558eb22b4e2bf649236fc64a8d12ccbd41656baab6569d838b2730adbb8832a3c8ee8dad3642c4889afe67a862ce0b30839ce5894d39a8ec75c82e409fd58da2267b651bd3b333af681d97ee495deacfba5d6e7db01956244af7ee93f60a1fa5578501fa793381c48d3af4f5f2bc740858f1a5b0fa5f9b0ed4312001ce17b8121fe593a4a9aad503676eb0cb4b60921b29fb6c6186a6492d2c0797e4c2396c7b253264e7d5611c6602553a76ab582ae69c4a2bafbc7d1c6efdcc02bfefc8c0d8379dd569e06d0971ebb5618b37ee0e3cd9b92054875426609a5f3b1b721f2e8653de55292d4222901f7352e07c51f696a390a36580d213cdf7eb81e3a1980fdf89031f7197ffa413516649e7947946e6a059448a08ca215580b65327b6afb39a4b346e8a281fc8f72dbe72ebc527d3e425aeccb19736634cbca6a8f741ba98618839116c582240f3ee2bed6dfe91d5cc4c272b8fdef66d4e5413e1539c69b21fce6c76573c4f372e286b5e56995e9526466ac202bdd7c878ae6ce7f902720d413d8724414f61884614193c4b7b0b9a6fd35b9ae9efa9ea97ab76c7a307e169c4d7ae8120746acf10fabcaef452e0f322ab197f5b690401030d39458cc523af2e1983d6692fc130c45c4c47f221093ae8da22957689109e8d7374d95882736de07783479e270171e9103412b560d3e2f681dcf859fad1544bfe99d3e0a09ba68097f27d41d5375ba50f8c9ddc966d55f1b2a2ffcc2e76024c8e925dd40e1af888fe09247f5cdc9d8615409b5acaaa23c50d4934bb8bccafce755703e752310f441d14a5c2499ed3c7c2e975655bb6c42c31b37ee7c0e8baadc83ebc69d9cbcc2a5bfe5279bad54090bd1a5e6f666926f38439162dadd9d3c356591819decc025d14d318f844825f637716154ac80ea390dd2311727af74dfe0e425adb2009adc1eb39766e9d225852b442651000f2b12322452b3239ca8e1a07e94fa5fe71854aa8ad14f98eeac98f3e022e3749392c071fbe34d1c9cad004f57d4d1509da1c5ace6ec73e215f1305fb234025b9148e97dce4e4cd45712f9df1a819d4efcd4e0829e6c4cdbb163857a0380f7f39cb8243cbc3a13abef1a55971124b8da456458c8e870ce03a37e8ed01f01e95c21d56d1411f5eabd4823c38e5505b0e79f83176a4627361feae5dce41c8377f3849c8b2d5c17a25955d6bcab244cd17fd6b954e30512415e665fc0b13112550e21fb16c849f895a44dc2bc0471141141f19037228f2c43f4c75d10082c844de41b2b0270ce184b02fa8ce1c0a1f0d5605606f2bcaef906994bbea3c29fcaf586df6d6f9e817c855640a71ad669696027ab3117f8f999d688271f9b6856540e9039398ccb56aafd1d0576378fb25fc31aa577a6a8f43ff83325211e41e31c9c920a449efb56857b6e70bf6be7cc2c7480622d966465e04593815812a5a9f9c6bb5e3f0f921a8412dd2bc1a4591e5c5d5a3e8f99bc6a22cd1fbeeb601a5b9056c97df3f20ae23fe95f0d8c55b62db48a00930fece5489bd85ac456c4d6cf806bce15cefb2539cbc6d3352f95b6715a9d71bdfca5fa553024f5df1027b5650206384525c47f0301e538ce9b18a9e71e6346bdaa8b075a81ee537e1634001e26c0cbe42df10bb5cad500bfc44465786b0970f50f7ce3cb2a4ce4e026f91057f85690cca8da1de48d750524e68b27ae6668923392131f83b90832aa59b2ec8c406fd6ba1a796b8a6c64b4155354f0f9e7f1fb505f1ad9fce63f45430badb8f1070c43f4de7588da0b57a7b80502027780de9d2ce6535282bd6f4d9405eab01e2d3c73ab745fcac72903e23c62f8913aa459bdd3b2d98a635a2d0179b4b5848c01c0f0fcff01959fa73f69ccbf3ab7ff2ce0e46b3390d8e75621ff403ddc17fa30002b597c8dbb2395703f7dce35df685cdf5892f641898176a77836baa9a947794e2a39d229523468dc041024a748ea2ddc5bacadfeacffc10588b74d7b37bbc07a951c1aceacfd453f268741949915cf1e505efb983732ebdacfe68ca860e8e06e9e0d702cc8fb6d7392bba", 0x1000}, {&(0x7f0000003880)="d29782d4a218bdf2035dbeb54e5a7cc4a03648a9d5a6a5d08296d5605566e2400ad925166e13cf887de513c11355b717547dc0d1662dfe8e247f939c224cc5fb9c677625af78b1471d0a4a3566bd7a1dd7d07ae0a9c84e4cf1813bff4aeec44197e44d7b4c36d59549da12b01c7cb5ef5393482f7607e303560772287b14477e44f1c766893a7f5c597ea648aeb011dd48bbeeb390a3ef76e52c492bebc1598446eb06248efe0e39b6928f1979063dfd93f182d8792985c0da443c349eb13b7f594c38ca9c38e937501889aff704ef2d930f74a4fa", 0xd5}], 0x7, &(0x7f0000003a00)={0xa0, 0x118, 0x8, "c45d10d9508f01738d5a0038d4c286419719d342f4a20d202f9bf0fff8c4329cb76621c9aa37a7209206352b2e352472f5361cd530e908ed1056e9a766d9f8eeaad5a12352861c4eef68cdb6c39667c5ac169867f67fce2b36cdf1100559ac3dc8ec8c10c83569b032f2cd960cb4514580067340b25057fa1f6e5c999e1938608360f4b401dac189dd75abe19a79"}, 0xa0}], 0x7, 0x8000) 13:11:59 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1668.551066][T22974] validate_nla: 3 callbacks suppressed [ 1668.551079][T22974] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x7ffff000, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1668.634158][T22980] 9pnet_virtio: no channels available for device /dev/video2 13:11:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1668.739091][T22980] 9pnet_virtio: no channels available for device /dev/video2 13:11:59 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x277, 0x20900) ioctl$SIOCX25GSUBSCRIP(r2, 0x89e0, &(0x7f00000000c0)={'bond0\x00', 0x9, 0x643a2e08}) 13:11:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xfffffdef, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1668.829790][T22999] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:59 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:11:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x2, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1669.067468][T23016] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:11:59 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:11:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:11:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:11:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x3, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1669.332801][T23038] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:00 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x58000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1669.612347][T23057] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1669.674357][T23056] binder: BINDER_SET_CONTEXT_MGR already set [ 1669.744461][T23056] binder: 23054:23056 ioctl 4018620d 200000c0 returned -16 13:12:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x80) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) fsetxattr$security_capability(r1, &(0x7f0000000040)='security.capability\x00', &(0x7f00000000c0)=@v1={0x1000000, [{0x7, 0x7}]}, 0xc, 0x1) 13:12:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:02 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x4, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:02 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:02 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x10080, 0x20) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') sendmsg$FOU_CMD_DEL(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x300, 0x70bd26, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e22}, @FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e20}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @empty}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8811) close(r1) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 1672.241856][T23081] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x5, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:02 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) epoll_create(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xcd84}, 0x800000200000000, 0x2}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0x0, 0x0, 0x0) 13:12:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:02 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1672.509906][T23106] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:03 executing program 3: r0 = mq_open(&(0x7f0000000140)='eth0\x00', 0x0, 0x0, 0x0) mq_getsetattr(r0, &(0x7f0000000040), 0x0) [ 1672.686374][T23114] binder: BINDER_SET_CONTEXT_MGR already set [ 1672.721921][T23114] binder: 23112:23114 ioctl 4018620d 200000c0 returned -16 13:12:05 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x6, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:05 executing program 3: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x800000, 0x3, &(0x7f00007fb000/0x800000)=nil) 13:12:05 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1675.364207][T23132] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x7, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) listen(r1, 0x0) 13:12:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1675.484442][T23150] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1675.735043][T23168] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:08 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 13:12:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x8, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:08 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:08 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1678.436258][T23181] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x9, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000002c0)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000090000006b9805e17c310000e002000000000000100100000000000000000000000000004802000048020000480204004802000048"], 0x1) [ 1678.562760][T23187] binder: BINDER_SET_CONTEXT_MGR already set 13:12:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1678.607278][T23187] binder: 23179:23187 ioctl 4018620d 200000c0 returned -16 13:12:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xa, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:09 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:09 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:09 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1678.840994][T23215] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xb, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1679.120113][T23240] ERROR: Domain ' /sbin/init /etc/init.d/rc /sbin/startpar /etc/init.d/ssh /sbin/start-stop-daemon /usr/sbin/sshd /usr/sbin/sshd /bin/bash /root/syz-fuzzer /root/syz-executor.3 proc:/self/fd/5' not defined. 13:12:09 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1679.217519][T23242] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xc, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xd, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:10 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1679.647055][T23271] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:12 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xe, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:12 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:12 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f7f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1682.014406][T23296] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:12 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xf, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:12 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1682.386631][T23332] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:15 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x11, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:15 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:15 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:15 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1685.132900][T23357] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x12, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1685.197167][T23362] binder: BINDER_SET_CONTEXT_MGR already set 13:12:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1685.288392][T23362] binder: 23349:23362 ioctl 4018620d 200000c0 returned -16 13:12:15 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1685.373605][T23378] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x14, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1685.587561][T23396] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x2f, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1685.847869][T23420] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x39, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1685.977137][T23427] binder: BINDER_SET_CONTEXT_MGR already set [ 1686.025442][T23427] binder: 23421:23427 ioctl 4018620d 200000c0 returned -16 13:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x5a, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2800000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1686.148065][T23443] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:19 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000180)) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r2) socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x400000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @multicast2, @loopback}, &(0x7f0000000100)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000140)={@rand_addr="bfdcafaee5835584b56a30b529fa4c08", 0x1, r4}) 13:12:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x67, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1688.625652][T23462] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x20005d10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1688.739380][T23477] binder: BINDER_SET_CONTEXT_MGR already set [ 1688.745431][T23477] binder: 23467:23477 ioctl 4018620d 200000c0 returned -16 13:12:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:19 executing program 3: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x5800000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1688.969827][T23497] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd04, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1689.228937][T23513] binder: BINDER_SET_CONTEXT_MGR already set [ 1689.234992][T23513] binder: 23512:23513 ioctl 4018620d 200000c0 returned -16 13:12:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1689.316835][T23513] binder_alloc: 4596: binder_alloc_buf, no vma 13:12:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1689.356975][T23529] binder: BINDER_SET_CONTEXT_MGR already set 13:12:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd08, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1689.409343][T23527] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1689.418285][T23529] binder: 23514:23529 ioctl 4018620d 200000c0 returned -16 13:12:20 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:20 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1689.661999][T23553] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd10, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd14, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:20 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1689.884269][T23571] binder: BINDER_SET_CONTEXT_MGR already set [ 1689.906462][T23571] binder: 23558:23571 ioctl 4018620d 200000c0 returned -16 [ 1689.993941][T23576] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:20 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd38, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:20 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:20 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1690.399131][T23613] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd39, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:21 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd5a, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1690.600942][T23629] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1690.636268][T23632] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:21 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1690.878620][T23647] binder: BINDER_SET_CONTEXT_MGR already set [ 1690.895141][T23647] binder: 23642:23647 ioctl 4018620d 200000c0 returned -16 13:12:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:23 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:23 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:23 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xffffffff00000000, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1693.056215][T23655] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1693.078634][T23656] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1693.117406][T23663] binder: BINDER_SET_CONTEXT_MGR already set [ 1693.152015][T23663] binder: 23652:23663 ioctl 4018620d 200000c0 returned -16 13:12:23 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:23 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f8f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:23 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:23 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:24 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1693.552830][T23693] binder: BINDER_SET_CONTEXT_MGR already set 13:12:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1693.616561][T23693] binder: 23682:23693 ioctl 4018620d 200000c0 returned -16 [ 1693.676818][T23704] validate_nla: 2 callbacks suppressed [ 1693.676830][T23704] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:24 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1693.722050][T23709] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:24 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1693.880387][T23721] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1693.934130][T23723] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:27 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:27 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:27 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) [ 1696.555814][T23737] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1696.602233][T23740] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1696.668529][T23739] binder: BINDER_SET_CONTEXT_MGR already set 13:12:27 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1696.710481][T23739] binder: 23733:23739 ioctl 4018620d 200000c0 returned -16 [ 1696.818749][T23761] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1696.899792][T23768] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1696.930284][T23771] binder: BINDER_SET_CONTEXT_MGR already set 13:12:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1696.965144][T23771] binder: 23764:23771 ioctl 4018620d 200000c0 returned -16 [ 1697.019003][T23776] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:30 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:30 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:30 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) [ 1699.627298][T23788] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1699.665290][T23795] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1699.727245][T23794] binder: BINDER_SET_CONTEXT_MGR already set 13:12:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1699.784947][T23794] binder: 23791:23794 ioctl 4018620d 200000c0 returned -16 13:12:30 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1699.853342][T23817] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1699.914168][T23820] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:12:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xf, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1700.058364][T23830] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:33 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:33 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:33 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x10, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:33 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) 13:12:33 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x5b, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1702.731034][T23854] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x10, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:33 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:33 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xc0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1703.031233][T23880] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x48, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1703.090520][T23885] binder: BINDER_SET_CONTEXT_MGR already set [ 1703.130277][T23885] binder: 23877:23885 ioctl 4018620d 200000c0 returned -16 [ 1703.192507][T23893] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xec0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x33fe0, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1705.834816][T23910] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x60, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x20000088, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9a01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1706.179286][T23942] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x68, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x7ffff000, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1706.482838][T23967] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9b01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0xfffffdef, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1706.630008][T23980] binder: BINDER_SET_CONTEXT_MGR already set [ 1706.707929][T23980] binder: 23973:23980 ioctl 4018620d 200000c0 returned -16 [ 1706.756262][T23996] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9c01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:37 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:37 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x2, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x74, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1706.963630][T24010] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x3, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:37 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9d01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:37 executing program 5: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x4, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1707.321747][T24040] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:38 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x5, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9e01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1707.665533][T24072] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x6, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x300, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1707.730880][T24078] binder: BINDER_SET_CONTEXT_MGR already set [ 1707.742911][T24078] binder: 24063:24078 ioctl 4018620d 200000c0 returned -16 13:12:38 executing program 5: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1707.882732][T24088] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:40 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f9f01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:40 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x7, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x337, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x8, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x500, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1710.316298][T24111] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1710.343374][T24115] binder: BINDER_SET_CONTEXT_MGR already set 13:12:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1710.411476][T24115] binder: 24106:24115 ioctl 4018620d 200000c0 returned -16 [ 1710.443734][T24125] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:41 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x9, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x600, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:41 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1710.733812][T24142] binder: BINDER_SET_CONTEXT_MGR already set [ 1710.745859][T24142] binder: 24141:24142 ioctl 4018620d 200000c0 returned -16 13:12:41 executing program 5: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xa, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x700, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:43 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:43 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5800, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:43 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xb, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1713.366447][T24160] validate_nla: 1 callbacks suppressed [ 1713.366458][T24160] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xc, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:44 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1713.642151][T24191] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1713.779590][T24198] binder: BINDER_SET_CONTEXT_MGR already set [ 1713.812819][T24198] binder: 24188:24198 ioctl 4018620d 200000c0 returned -16 13:12:44 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:44 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xd, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xe, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1714.027804][T24218] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0xf, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1714.311753][T24243] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:47 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x11, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:47 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:47 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1717.076117][T24267] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x12, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x1543, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1717.198261][T24284] binder: BINDER_SET_CONTEXT_MGR already set [ 1717.238076][T24284] binder: 24266:24284 ioctl 4018620d 200000c0 returned -16 13:12:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:47 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x14, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1717.325343][T24295] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:48 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x2f, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1717.608235][T24314] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x39, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:48 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1717.909675][T24335] binder: BINDER_SET_CONTEXT_MGR already set [ 1717.930883][T24335] binder: 24327:24335 ioctl 4018620d 200000c0 returned -16 13:12:50 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3703, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:50 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x5b, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fa901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:50 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:50 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1720.096719][T24345] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067faa01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:50 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x67, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1720.302893][T24376] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:50 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:50 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4315, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1720.538540][T24394] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:53 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x20005d10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fab01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:53 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4800, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd04, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1723.219345][T24413] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fac01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd08, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1723.340117][T24416] binder: BINDER_SET_CONTEXT_MGR already set [ 1723.374827][T24416] binder: 24411:24416 ioctl 4018620d 200000c0 returned -16 13:12:54 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:54 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1723.473213][T24433] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5865, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1723.686297][T24450] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1723.691814][T24444] binder: BINDER_SET_CONTEXT_MGR already set [ 1723.774590][T24444] binder: 24443:24444 ioctl 4018620d 200000c0 returned -16 13:12:56 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd10, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fad01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:56 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:12:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd14, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1726.296053][T24471] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fae01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6558, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1726.379524][T24477] binder: BINDER_SET_CONTEXT_MGR already set [ 1726.397607][T24477] binder: 24464:24477 ioctl 4018620d 200000c0 returned -16 13:12:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd38, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:57 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1726.550774][T24492] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:57 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067faf01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1726.808663][T24507] binder: BINDER_SET_CONTEXT_MGR already set [ 1726.833978][T24507] binder: 24500:24507 ioctl 4018620d 200000c0 returned -16 13:12:59 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:12:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6800, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd39, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:12:59 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1729.338250][T24526] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1729.359460][T24528] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:12:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd5b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:12:59 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1729.415846][T24536] binder: BINDER_SET_CONTEXT_MGR already set [ 1729.497033][T24543] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1729.506950][T24536] binder: 24524:24536 ioctl 4018620d 200000c0 returned -16 13:13:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1729.541018][T24545] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1729.714480][T24557] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:00 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7400, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:00 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1729.886782][T24570] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1729.945553][T24571] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:00 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1730.208848][T24600] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:00 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x8100, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:00 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1730.421197][T24610] binder: BINDER_SET_CONTEXT_MGR already set [ 1730.451438][T24610] binder: 24608:24610 ioctl 4018620d 200000c0 returned -16 13:13:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:01 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1730.925550][T24665] binder: BINDER_SET_CONTEXT_MGR already set [ 1730.986411][T24665] binder: 24653:24665 ioctl 4018620d 200000c0 returned -16 13:13:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffe, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:01 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(0x0, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1731.490717][T24712] validate_nla: 9 callbacks suppressed [ 1731.490729][T24712] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:02 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1731.583412][T24723] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x34000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:02 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1731.740188][T24741] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:02 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1731.855712][T24751] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1731.878743][T24753] binder: BINDER_SET_CONTEXT_MGR already set 13:13:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x400300, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1731.922377][T24753] binder: 24737:24753 ioctl 4018620d 200000c0 returned -16 13:13:02 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1732.048444][T24762] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:02 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1732.174172][T24781] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fb901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x10, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1732.303784][T24790] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:02 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:02 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x1000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1732.433541][T24801] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x48, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fba01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:03 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1732.613814][T24816] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:03 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1732.708465][T24822] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1732.753278][T24818] binder: BINDER_SET_CONTEXT_MGR already set 13:13:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1732.812520][T24818] binder: 24814:24818 ioctl 4018620d 200000c0 returned -16 13:13:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fbb01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:03 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x60, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fbc01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:03 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x68, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:03 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fbd01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1733.575986][T24893] binder: BINDER_SET_CONTEXT_MGR already set [ 1733.641879][T24893] binder: 24892:24893 ioctl 4018620d 200000c0 returned -16 13:13:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x74, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:04 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1733.944519][T24926] binder: BINDER_SET_CONTEXT_MGR already set [ 1733.966304][T24926] binder: 24922:24926 ioctl 4018620d 200000c0 returned -16 13:13:06 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:06 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fbe01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:07 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x300, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fbf01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1736.503188][T24943] binder: BINDER_SET_CONTEXT_MGR already set [ 1736.517915][T24943] binder: 24941:24943 ioctl 4018620d 200000c0 returned -16 13:13:07 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1736.656070][T24962] validate_nla: 14 callbacks suppressed [ 1736.656083][T24962] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1736.752065][T24965] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1736.774447][T24974] binder: BINDER_SET_CONTEXT_MGR already set [ 1736.817953][T24974] binder: 24970:24974 ioctl 4018620d 200000c0 returned -16 13:13:09 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1739.365131][T24986] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:10 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x337, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:10 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:10 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1739.564999][T25000] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x10000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1739.607579][T25005] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1739.643376][T25013] binder: BINDER_SET_CONTEXT_MGR already set 13:13:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x500, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1739.677035][T25013] binder: 24995:25013 ioctl 4018620d 200000c0 returned -16 [ 1739.760433][T25026] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:10 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1739.833818][T25030] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x20000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x600, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1739.970083][T25041] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1740.019023][T25045] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:13 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:13 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x37030000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x700, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:13 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1742.628107][T25059] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1742.658085][T25053] binder: BINDER_SET_CONTEXT_MGR already set [ 1742.664693][T25056] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1742.687979][T25053] binder: 25051:25053 ioctl 4018620d 200000c0 returned -16 13:13:13 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x40000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1742.807632][T25077] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1742.919778][T25086] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1742.990538][T25091] binder: BINDER_SET_CONTEXT_MGR already set [ 1743.025138][T25097] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x43150000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1743.037181][T25091] binder: 25081:25091 ioctl 4018620d 200000c0 returned -16 [ 1743.120305][T25099] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:16 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x48000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1745.723119][T25114] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1745.750944][T25118] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1745.946197][T25138] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x60000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1745.993531][T25140] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:16 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x14fd, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x65580000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1746.535274][T25182] binder: BINDER_SET_CONTEXT_MGR already set [ 1746.585039][T25182] binder: 25178:25182 ioctl 4018620d 200000c0 returned -16 13:13:19 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x68000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fc901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1748.710079][T25189] validate_nla: 3 callbacks suppressed [ 1748.710090][T25189] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1748.794622][T25194] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3703, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fca01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1748.978199][T25218] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3f00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1749.110712][T25229] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1749.249351][T25242] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:22 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:22 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fcb01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x74000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:22 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1751.794947][T25256] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1751.843950][T25258] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fcc01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4800, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:22 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:22 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1752.066024][T25287] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1752.116894][T25293] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x81000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1752.316501][T25310] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:25 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fcd01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:25 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x88a8ffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1754.866999][T25320] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1754.895281][T25317] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x9effffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fce01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5865, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:25 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:25 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1755.092319][T25335] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1755.159301][T25341] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:25 executing program 3: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fcf01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:25 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1755.359735][T25358] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:25 executing program 3: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1755.445165][T25367] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff0000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1755.546003][T25373] binder: BINDER_SET_CONTEXT_MGR already set 13:13:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6558, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1755.589772][T25373] binder: 25370:25373 ioctl 4018620d 200000c0 returned -16 13:13:26 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1755.695249][T25393] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1755.734799][T25396] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1755.930571][T25408] binder: BINDER_SET_CONTEXT_MGR already set [ 1755.938019][T25408] binder: 25401:25408 ioctl 4018620d 200000c0 returned -16 13:13:28 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f0000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:28 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6800, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:28 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1758.279001][T25415] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1758.319949][T25422] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1758.334559][T25418] binder: BINDER_SET_CONTEXT_MGR already set 13:13:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffa888, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1758.368891][T25418] binder: 25416:25418 ioctl 4018620d 200000c0 returned -16 13:13:29 executing program 3: ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:29 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffff000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff7f, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1758.741656][T25456] binder: BINDER_SET_CONTEXT_MGR already set [ 1758.766440][T25456] binder: 25446:25456 ioctl 4018620d 200000c0 returned -16 13:13:31 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:31 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7400, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:31 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff9e, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:31 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1761.362121][T25468] validate_nla: 4 callbacks suppressed [ 1761.362134][T25468] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1761.403305][T25473] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:31 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a00, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffffff0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:32 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1761.559615][T25494] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1761.668928][T25506] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x8100, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1761.818341][T25512] binder: BINDER_SET_CONTEXT_MGR already set [ 1761.826884][T25512] binder: 25509:25512 ioctl 4018620d 200000c0 returned -16 [ 1761.843486][T25516] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:34 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x40030000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:34 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:34 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:34 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1764.481818][T25534] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1764.512580][T25536] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffffffffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfd14, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:35 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fd901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1764.756690][T25560] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:35 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1764.851510][T25565] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x100000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:35 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fda01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1765.030237][T25584] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1765.215953][T25590] binder: BINDER_SET_CONTEXT_MGR already set [ 1765.238376][T25590] binder: 25586:25590 ioctl 4018620d 200000c0 returned -16 13:13:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x200000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fdb01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:37 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffe, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1767.494716][T25612] validate_nla: 2 callbacks suppressed [ 1767.494729][T25612] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1767.518958][T25614] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x300000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1767.592763][T25612] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1767.734629][T25633] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:38 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:38 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x34000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fdc01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:38 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x400000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1767.948005][T25642] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1767.993821][T25639] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x400300, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x500000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:38 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fdd01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1768.191552][T25667] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1768.259884][T25669] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x600000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1768.310371][T25673] binder: BINDER_SET_CONTEXT_MGR already set [ 1768.327264][T25673] binder: 25672:25673 ioctl 4018620d 200000c0 returned -16 [ 1768.375279][T25682] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1768.467149][T25687] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:41 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fde01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:41 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:41 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x1000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x700000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fdf01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:41 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:41 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1771.554496][T25739] binder: BINDER_SET_CONTEXT_MGR already set [ 1771.563657][T25739] binder: 25738:25739 ioctl 4018620d 200000c0 returned -16 13:13:44 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:44 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(0xffffffffffffffff, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r1, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1774.125195][T25749] validate_nla: 6 callbacks suppressed [ 1774.125207][T25749] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1774.171599][T25759] binder: BINDER_SET_CONTEXT_MGR already set [ 1774.177635][T25759] binder: 25751:25759 ioctl 4018620d 200000c0 returned -16 [ 1774.184731][T25757] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x5000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:44 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1774.347861][T25777] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1774.469511][T25790] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:45 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:45 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x1000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1774.653145][T25800] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1774.688940][T25803] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1774.761525][T25809] binder: BINDER_SET_CONTEXT_MGR already set 13:13:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1774.828218][T25809] binder: 25801:25809 ioctl 4018620d 200000c0 returned -16 [ 1774.847055][T25820] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1774.955549][T25825] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:47 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:47 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3703000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1777.161118][T25835] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1777.189333][T25837] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1777.204533][T25840] binder: BINDER_SET_CONTEXT_MGR already set 13:13:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1777.259087][T25840] binder: 25829:25840 ioctl 4018620d 200000c0 returned -16 13:13:48 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:48 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:48 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:50 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4315000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:50 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:50 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1780.226525][T25890] validate_nla: 3 callbacks suppressed [ 1780.226538][T25890] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:50 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x10000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1780.270404][T25900] binder: BINDER_SET_CONTEXT_MGR already set [ 1780.276420][T25895] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1780.301822][T25900] binder: 25889:25900 ioctl 4018620d 200000c0 returned -16 [ 1780.439596][T25913] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:51 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4800000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:51 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x20000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1780.805006][T25925] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1780.851506][T25928] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1780.872564][T25924] binder: BINDER_SET_CONTEXT_MGR already set [ 1780.899124][T25924] binder: 25923:25924 ioctl 4018620d 200000c0 returned -16 13:13:53 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fe901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x37030000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:53 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1783.290673][T25952] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1783.307326][T25953] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3f000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fea01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1783.375657][T25959] binder: BINDER_SET_CONTEXT_MGR already set [ 1783.399243][T25959] binder: 25948:25959 ioctl 4018620d 200000c0 returned -16 [ 1783.484066][T25970] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:54 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:54 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:54 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x40000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067feb01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1783.881190][T25986] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1783.915354][T25987] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:56 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6558000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x48000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fec01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:56 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1786.339268][T26008] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1786.355844][T26012] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:13:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6800000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1786.463839][T26018] binder: BINDER_SET_CONTEXT_MGR already set [ 1786.515898][T26018] binder: 26013:26018 ioctl 4018620d 200000c0 returned -16 [ 1786.529962][T26029] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1786.574444][T26033] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:13:57 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fed01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:57 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:13:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x60000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1786.945561][T26044] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1786.978048][T26048] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1787.040493][T26054] binder: BINDER_SET_CONTEXT_MGR already set [ 1787.090847][T26054] binder: 26043:26054 ioctl 4018620d 200000c0 returned -16 13:13:59 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:13:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x65580000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7400000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:13:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fee01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:13:59 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1789.438637][T26068] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1789.455556][T26072] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x68000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1789.490047][T26070] binder: BINDER_SET_CONTEXT_MGR already set [ 1789.518817][T26070] binder: 26069:26070 ioctl 4018620d 200000c0 returned -16 [ 1789.606617][T26084] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1789.694445][T26091] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:00 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fef01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x8100000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:00 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1790.090896][T26107] binder: BINDER_SET_CONTEXT_MGR already set [ 1790.118599][T26107] binder: 26094:26107 ioctl 4018620d 200000c0 returned -16 13:14:02 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x0, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x74000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x88a8ffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff001ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:03 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1792.526951][T26124] validate_nla: 2 callbacks suppressed [ 1792.526964][T26124] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1792.554100][T26125] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:03 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff101ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x9effffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1792.779952][T26148] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1792.806766][T26150] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:03 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1792.941872][T26160] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:03 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1793.024673][T26163] binder: BINDER_SET_CONTEXT_MGR already set [ 1793.060042][T26163] binder: 26162:26163 ioctl 4018620d 200000c0 returned -16 13:14:06 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff201ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x81000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1795.595476][T26185] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1795.620719][T26184] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1795.638325][T26187] binder: BINDER_SET_CONTEXT_MGR already set 13:14:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x88a8ffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1795.669645][T26187] binder: 26182:26187 ioctl 4018620d 200000c0 returned -16 13:14:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff301ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1795.786337][T26202] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:06 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1795.880583][T26207] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1795.912646][T26209] binder: BINDER_SET_CONTEXT_MGR already set 13:14:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff7f00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1795.936607][T26209] binder: 26208:26209 ioctl 4018620d 200000c0 returned -16 [ 1796.020533][T26220] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:06 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x9effffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff401ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffffffffffff000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x2, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff501ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:06 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfd140000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1796.579529][T26269] binder: BINDER_SET_CONTEXT_MGR already set [ 1796.592317][T26269] binder: 26265:26269 ioctl 4018620d 200000c0 returned -16 13:14:09 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x0, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x3, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1798.989228][T26277] validate_nla: 5 callbacks suppressed [ 1798.989235][T26277] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:09 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff601ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff0000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:09 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1799.284312][T26294] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1799.312531][T26293] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1799.320173][T26290] binder: BINDER_SET_CONTEXT_MGR already set 13:14:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff701ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x5, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f0000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:09 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1799.356840][T26290] binder: 26289:26290 ioctl 4018620d 200000c0 returned -16 [ 1799.475223][T26312] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffa888, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1799.532916][T26309] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1799.586136][T26320] binder: BINDER_SET_CONTEXT_MGR already set [ 1799.616283][T26320] binder: 26314:26320 ioctl 4018620d 200000c0 returned -16 [ 1799.688251][T26325] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff801ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1802.026338][T26332] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:12 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(0x0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:12 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:12 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffff000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x7, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ff901ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1802.351747][T26344] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1802.371723][T26350] binder: BINDER_SET_CONTEXT_MGR already set [ 1802.389643][T26348] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xa, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:12 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(0x0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1802.431087][T26350] binder: 26342:26350 ioctl 4018620d 200000c0 returned -16 13:14:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ffa01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff7f, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:13 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1802.556962][T26364] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xc, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff9e, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xe, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:15 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ffb01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:15 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfffffff0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xf, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1805.352670][T26402] validate_nla: 4 callbacks suppressed [ 1805.352682][T26402] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1805.377650][T26405] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:16 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(0x0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x40030000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x10, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ffc01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5800000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:16 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1805.664372][T26425] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1805.714046][T26430] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffffffffff, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x48, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ffd01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:16 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1805.937026][T26452] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1806.004398][T26459] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x100000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4c, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067ffe01ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:16 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1806.150357][T26469] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x200000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1806.229735][T26474] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x60, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1806.358618][T26485] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1806.407995][T26479] binder: BINDER_SET_CONTEXT_MGR already set [ 1806.451022][T26479] binder: 26475:26479 ioctl 4018620d 200000c0 returned -16 [ 1806.471859][T26494] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:19 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0102ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x300000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x68, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:19 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6c, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x400000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:19 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0202ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1809.029433][T26535] binder: BINDER_SET_CONTEXT_MGR already set [ 1809.035481][T26535] binder: 26528:26535 ioctl 4018620d 200000c0 returned -16 13:14:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x74, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x500000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:22 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:22 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000, 0x58, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:22 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x7a, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0302ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x600000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1811.797818][T26562] validate_nla: 6 callbacks suppressed [ 1811.797829][T26562] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1811.856496][T26566] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x700000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1811.899471][T26563] binder: BINDER_SET_CONTEXT_MGR already set 13:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xf0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1811.948164][T26563] binder: 26557:26563 ioctl 4018620d 200000c0 returned -16 13:14:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0402ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:22 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1812.064028][T26587] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1812.146888][T26589] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xa00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x300, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1812.279149][T26602] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1812.292984][T26603] binder: BINDER_SET_CONTEXT_MGR already set [ 1812.347371][T26609] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1812.356168][T26603] binder: 26596:26603 ioctl 4018620d 200000c0 returned -16 13:14:25 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x0, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0502ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xc00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:25 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x337, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:25 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1814.853081][T26617] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1814.912842][T26622] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xe00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:25 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x500, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:25 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0602ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1815.169813][T26645] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1815.215057][T26649] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:25 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:25 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x600, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1815.286865][T26656] binder: BINDER_SET_CONTEXT_MGR already set [ 1815.325884][T26656] binder: 26652:26656 ioctl 4018620d 200000c0 returned -16 13:14:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0702ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x700, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x1000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0802ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x2000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xa00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1815.795309][T26703] binder: BINDER_SET_CONTEXT_MGR already set [ 1815.805943][T26703] binder: 26689:26703 ioctl 4018620d 200000c0 returned -16 13:14:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3703000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xc00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x0, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0902ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:26 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x3f00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xe00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0a02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:27 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xf00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:27 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0b02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:27 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1816.991616][T26806] binder: BINDER_SET_CONTEXT_MGR already set [ 1817.000645][T26806] binder: 26795:26806 ioctl 4018620d 200000c0 returned -16 13:14:29 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x1543, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4800000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:29 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0c02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:29 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1819.255758][T26819] validate_nla: 12 callbacks suppressed [ 1819.255768][T26819] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x2000, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:29 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1819.304634][T26820] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1819.333094][T26828] binder: BINDER_SET_CONTEXT_MGR already set 13:14:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0d02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1819.387225][T26828] binder: 26816:26828 ioctl 4018620d 200000c0 returned -16 13:14:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x4c00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:30 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1819.532833][T26846] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0e02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1819.628902][T26857] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1819.691629][T26840] cgroup: fork rejected by pids controller in /syz5 13:14:32 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x3703, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:32 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6000000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:32 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f0f02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1822.337495][T26960] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1822.353226][T26965] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6558000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4000, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1002ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1822.524035][T27021] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:33 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:33 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6800000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:33 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1822.667136][T27092] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1822.792849][T27102] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:35 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x0, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4315, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:35 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x73, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1102ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x6c00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:35 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1825.392945][T27218] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1825.413740][T27221] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7400000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4800, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1825.489944][T27222] binder: BINDER_SET_CONTEXT_MGR already set 13:14:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1202ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1825.576511][T27222] binder: 27220:27222 ioctl 4018620d 200000c0 returned -16 [ 1825.602444][T27264] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1825.682592][T27285] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:36 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x4c00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x7a00000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1302ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1825.998949][T27364] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:36 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1826.081883][T27370] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x5865, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1402ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x8100000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1826.227103][T27380] binder: BINDER_SET_CONTEXT_MGR already set [ 1826.268492][T27380] binder: 27372:27380 ioctl 4018620d 200000c0 returned -16 [ 1826.291861][T27388] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1826.327589][T27410] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x88a8ffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:36 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000258, 0x18, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6000, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1826.506724][T27501] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1826.557173][T27503] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1826.570321][T27500] binder_alloc: 27498: binder_alloc_buf size 536871552 failed, no address space [ 1826.602404][T27500] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1826.677965][T27506] binder: BINDER_SET_CONTEXT_MGR already set [ 1826.700465][T27506] binder: 27498:27506 ioctl 4018620d 200000c0 returned -16 13:14:39 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1502ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:39 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x9effffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6558, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:39 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x2f, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6800, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xf0ffffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1602ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:39 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x58, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x6c00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfd14000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1702ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:39 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xfeff000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:39 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x70, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1829.586183][T27579] binder: BINDER_SET_CONTEXT_MGR already set [ 1829.636579][T27579] binder: 27572:27579 ioctl 4018620d 200000c0 returned -16 13:14:42 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5]}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) 13:14:42 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xff0f000000000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x7400, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1802ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:42 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x200002d8, &(0x7f0000000200)={@flat, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) 13:14:42 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1831.919338][T27605] validate_nla: 7 callbacks suppressed [ 1831.919348][T27605] netlink: 'syz-executor.2': attribute type 11 has an invalid length. [ 1831.948245][T27612] binder_alloc: 27607: binder_alloc_buf size 536871744 failed, no address space 13:14:42 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1831.977100][T27612] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1831.987066][T27614] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:42 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffff7f00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1832.030744][T27612] binder: BINDER_SET_CONTEXT_MGR already set [ 1832.061795][T27612] binder: 27607:27612 ioctl 4018620d 200000c0 returned -16 13:14:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1902ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x7a00, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1832.170092][T27654] netlink: 'syz-executor.2': attribute type 11 has an invalid length. 13:14:42 executing program 0: write(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000001c0)={0x5, 0x7, 0xfffffffffffffff9, 0x5f5, 0x7f, 0x0, 0x7}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xa9, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r3 = fcntl$dupfd(r2, 0x406, r2) syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000300)={@mcast1}, &(0x7f0000000340)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000003c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8) fsetxattr$security_smack_transmute(r0, &(0x7f0000000700)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000740)='TRUE', 0x4, 0x1) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x14) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000006c0)) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f00000007c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="04000200"], 0x1}}, 0x200000d0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$binder(&(0x7f00000a0000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xa00) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) close(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000880)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat=@binder={0x66642a85}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/10, 0xa}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}, 0x10}], 0x5f, 0x0, &(0x7f0000000800)="8e104d30b272619f18a20e7b3c498d87f8278223e252d0a5e1f7f94c4ca85bb566374da15c1679cb1e6b4c4c44b4e3fc7f3768d7534d7aa7b2428f74bab13139531a4cf785ad52877bdd275bcf4e5b24877da3f0d0a71daf5995249a2f59d1"}) [ 1832.270751][T27705] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 13:14:42 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0xffffffff00000000, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0xb, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0x8100, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) 13:14:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1a02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 13:14:42 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/rt_cache\x00') ioctl$TCSETX(r0, 0x5433, &(0x7f0000000280)={0x7f, 0x1ff, [0x80000001, 0x9, 0x0, 0x12, 0x5], 0xffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)='proc}GPLeth0^wlan0#:\x00', 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0xe) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', 0x0, 0x0, 0x1) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) tkill(r2, 0x20) timer_settime(0x0, 0x0, 0x0, 0x0) [ 1832.437571][T27711] WARNING: CPU: 1 PID: 27711 at drivers/android/binder.c:2369 binder_transaction_buffer_release+0x673/0x8f0 [ 1832.449063][T27711] Kernel panic - not syncing: panic_on_warn set ... [ 1832.454708][ T3881] kobject: 'loop1' (00000000ee508bd1): kobject_uevent_env [ 1832.455663][T27711] CPU: 1 PID: 27711 Comm: syz-executor.0 Not tainted 5.2.0-rc6 #40 [ 1832.455677][T27711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1832.455690][T27711] Call Trace: [ 1832.484024][T27711] dump_stack+0x172/0x1f0 [ 1832.488367][T27711] ? binder_transaction_buffer_release+0x580/0x8f0 [ 1832.493368][ T3881] kobject: 'loop1' (00000000ee508bd1): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1832.494875][T27711] panic+0x2cb/0x744 [ 1832.494902][T27711] ? __warn_printk+0xf3/0xf3 [ 1832.513624][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 [ 1832.520130][T27711] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1832.526380][T27711] ? __warn.cold+0x5/0x4d [ 1832.530722][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 [ 1832.535729][T27716] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1832.537232][T27711] __warn.cold+0x20/0x4d [ 1832.537252][T27711] ? _binder_node_inner_unlock+0x80/0xd0 [ 1832.537269][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 [ 1832.537292][T27711] report_bug+0x263/0x2b0 [ 1832.566035][T27711] do_error_trap+0x11b/0x200 [ 1832.570746][T27711] do_invalid_op+0x37/0x50 [ 1832.575166][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 [ 1832.580505][ T3881] kobject: 'loop4' (000000008aab24fc): kobject_uevent_env [ 1832.581845][T27711] invalid_op+0x14/0x20 [ 1832.581865][T27711] RIP: 0010:binder_transaction_buffer_release+0x673/0x8f0 [ 1832.581881][T27711] Code: 31 ff 41 89 c5 89 c6 e8 db 21 1e fc 45 85 ed 0f 85 2f 41 01 00 49 8d 47 40 48 89 85 50 fe ff ff e9 9d fa ff ff e8 3d 20 1e fc <0f> 0b e9 7f fc ff ff e8 31 20 1e fc 48 89 d8 45 31 c9 4c 89 fe 4c [ 1832.581889][T27711] RSP: 0018:ffff88805f927468 EFLAGS: 00010216 [ 1832.625904][T27711] RAX: 0000000000040000 RBX: 0000000000000058 RCX: ffffc90012c17000 [ 1832.633394][ T3881] kobject: 'loop4' (000000008aab24fc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1832.633975][T27711] RDX: 00000000000079a7 RSI: ffffffff8552a0f3 RDI: ffff8880923c5b88 [ 1832.652076][T27711] RBP: ffff88805f927650 R08: ffff88808e862600 R09: ffffed100bf24eb2 [ 1832.660051][T27711] R10: ffffed100bf24eb1 R11: ffff88805f92758f R12: ffff888096b5c6c0 [ 1832.668118][T27711] R13: 0000000000000060 R14: ffff88805f927628 R15: ffff8880957d4600 [ 1832.676117][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 13:14:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0xd07, 0x0, 0xf000, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x5, @mcast1}]}}}]}, 0x48}}, 0x0) [ 1832.682638][T27711] ? binder_transaction_buffer_release+0x673/0x8f0 [ 1832.689251][T27711] ? binder_update_ref_for_handle+0x490/0x490 [ 1832.695329][T27711] ? trace_hardirqs_off+0x62/0x220 [ 1832.700727][T27711] ? kfree+0x170/0x220 [ 1832.704927][T27711] ? binder_free_txn_fixups+0x15f/0x230 [ 1832.710496][T27711] ? trace_hardirqs_on+0x67/0x220 [ 1832.715538][T27711] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1832.721788][T27711] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1832.728063][T27711] binder_transaction+0x153d/0x6620 [ 1832.733296][T27711] ? binder_thread_read+0x3d00/0x3d00 13:14:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="c0dca5055e0bcfec7be070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) r2 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067f1b02ff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 1832.738680][T27711] ? mark_held_locks+0xf0/0xf0 [ 1832.743458][T27711] ? mark_held_locks+0xf0/0xf0 [ 1832.748241][T27711] ? __might_fault+0x12b/0x1e0 [ 1832.751692][ T3881] kobject: 'loop1' (00000000ee508bd1): kobject_uevent_env [ 1832.753033][T27711] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1832.766377][T27711] ? _copy_from_user+0xdd/0x150 [ 1832.771247][T27711] binder_thread_write+0x87e/0x2820 [ 1832.776457][T27711] ? mark_held_locks+0xf0/0xf0 [ 1832.781230][T27711] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 1832.786876][T27711] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1832.793140][T27711] ? binder_transaction+0x6620/0x6620 [ 1832.797258][ T3881] kobject: 'loop1' (00000000ee508bd1): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1832.798521][T27711] ? __might_fault+0x12b/0x1e0 [ 1832.798540][T27711] ? lock_downgrade+0x880/0x880 [ 1832.798557][T27711] ? lock_downgrade+0x880/0x880 [ 1832.798586][T27711] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1832.798600][T27711] ? _copy_from_user+0xdd/0x150 [ 1832.798618][T27711] binder_ioctl+0x102f/0x1833 [ 1832.798639][T27711] ? binder_thread_write+0x2820/0x2820 [ 1832.798655][T27711] ? tomoyo_path_number_perm+0x263/0x520 [ 1832.798675][T27711] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 1832.855869][T27711] ? binder_thread_write+0x2820/0x2820 [ 1832.861340][T27711] do_vfs_ioctl+0xd5f/0x1380 [ 1832.865957][T27711] ? ioctl_preallocate+0x210/0x210 [ 1832.871073][T27711] ? __fget+0x381/0x550 [ 1832.875326][T27711] ? ksys_dup3+0x3e0/0x3e0 [ 1832.879756][T27711] ? nsecs_to_jiffies+0x30/0x30 [ 1832.884628][T27711] ? tomoyo_file_ioctl+0x23/0x30 [ 1832.889581][T27711] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1832.895839][T27711] ? security_file_ioctl+0x8d/0xc0 [ 1832.900961][T27711] ksys_ioctl+0xab/0xd0 [ 1832.905132][T27711] __x64_sys_ioctl+0x73/0xb0 [ 1832.909741][T27711] do_syscall_64+0xfd/0x680 [ 1832.914265][T27711] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1832.920157][T27711] RIP: 0033:0x459519 [ 1832.924064][T27711] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1832.943683][T27711] RSP: 002b:00007f4b97c12c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1832.952107][T27711] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459519 [ 1832.960087][T27711] RDX: 0000000020000140 RSI: 00000000c0306201 RDI: 0000000000000006 [ 1832.968065][T27711] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1832.976044][T27711] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b97c136d4 [ 1832.984019][T27711] R13: 00000000004c09e1 R14: 00000000004d3788 R15: 00000000ffffffff [ 1832.993313][T27711] Kernel Offset: disabled [ 1832.997682][T27711] Rebooting in 86400 seconds..