000000c00060003ef09300000000000000008000300", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40040) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0xb8, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_LEVEL={0x44, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x80}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7}]}, @NL802154_ATTR_SEC_LEVEL={0x3c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7a}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x914, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x34, r6, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x34}}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) 00:50:04 executing program 3: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, 0xffffffffffffffff, 0x80000000) 00:50:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r4, 0x0, 0x0) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:04 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 3: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, 0xffffffffffffffff, 0x80000000) 00:50:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) [ 493.731097] binder: 1075:1078 ioctl c0306201 0 returned -14 00:50:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r0, 0x0) 00:50:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x3f) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x3f) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) [ 493.890123] binder: 1091:1098 ioctl c0306201 0 returned -14 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x3f) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:04 executing program 5: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00022dbd7000fddbdf250f00000005000f002000000000020000000c00060003ef09300000000000000008000300", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40040) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0xb8, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_LEVEL={0x44, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x80}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7}]}, @NL802154_ATTR_SEC_LEVEL={0x3c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7a}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x914, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x34, r6, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) 00:50:04 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 0: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00022dbd7000fddbdf250f00000005000f002000000000020000000c00060003ef09300000000000000008000300", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40040) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0xb8, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_LEVEL={0x44, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x80}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7}]}, @NL802154_ATTR_SEC_LEVEL={0x3c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7a}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x914, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x34, r6, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x3f) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) [ 494.020266] binder: 1109:1113 ioctl c0306201 0 returned -14 00:50:04 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 0: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@profile={'changeprofile ', '\'(.(\x00'}, 0x13) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r2 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r3, 0x80000000) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x3f) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) 00:50:04 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 5: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00022dbd7000fddbdf250f00000005000f002000000000020000000c00060003ef09300000000000000008000300", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40040) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000680)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0xb8, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_LEVEL={0x44, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x80}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7}]}, @NL802154_ATTR_SEC_LEVEL={0x3c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x7a}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x914, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x34, r6, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x6a) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c0000000102ef7b531e857dff0300000000000000000300000508000540000000030e0006007369702d32303030300000000600074000040500080008400000000108000840000000002000028006000340000100000a610340000000000c000280050018b6010000007fa50401c5fd78da26f46e0c5563b81e70e3bc173be24723790fedd74b03cbc903146e6533db9687f8ba18e2c0e1444535d36d7d5af4529ff233882ed784d206d646e6d71f258c0300000000000000071158ba5f8370c3baf658a1cee689da505ea1bd7131c9880229ef9d546294d8297d8a5a1dac1ba172e14e938ad2fb5a4395690947fd366a83372d84280af9d6e40c4c9bb9b59f77ab0000000000000001978081cf77074c45ef88a28d0610d17f5fec5a7bdfb49274d2477592d256eb50455bb860dad5000000"], 0x6c}, 0x1, 0x0, 0x0, 0x400e090}, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r1, 0xc00464c9, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1002) r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040)='net_prio.ifpriomap\x00', 0x2, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000180)='freezer.state\x00', 0x2, 0x0) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x104, 0x0, &(0x7f0000001840)=[@dead_binder_done, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000000c0)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/52, 0x34, 0x1, 0x8}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}, @exit_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001400)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/200, 0xc8, 0x2, 0x21}, @ptr={0x70742a85, 0x0, &(0x7f0000000400)=""/4096, 0x1000, 0x1, 0x2b}, @flat=@binder={0x73622a85, 0x100b, 0x1}}, &(0x7f0000001480)={0x0, 0x28, 0x50}}}, @register_looper, @enter_looper, @release={0x40046306, 0x1}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001500)={@fda={0x66646185, 0x5, 0x2, 0x1a}, @ptr={0x70742a85, 0x0, &(0x7f00000014c0)=""/7, 0x7, 0x1, 0x16}, @flat=@handle={0x73682a85, 0x100b, 0x1}}, &(0x7f0000001580)={0x0, 0x20, 0x48}}}, @exit_looper, @free_buffer], 0x0, 0x0, 0x0}) 00:50:04 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x6a) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c0000000102ef7b531e857dff0300000000000000000300000508000540000000030e0006007369702d32303030300000000600074000040500080008400000000108000840000000002000028006000340000100000a610340000000000c000280050018b6010000007fa50401c5fd78da26f46e0c5563b81e70e3bc173be24723790fedd74b03cbc903146e6533db9687f8ba18e2c0e1444535d36d7d5af4529ff233882ed784d206d646e6d71f258c0300000000000000071158ba5f8370c3baf658a1cee689da505ea1bd7131c9880229ef9d546294d8297d8a5a1dac1ba172e14e938ad2fb5a4395690947fd366a83372d84280af9d6e40c4c9bb9b59f77ab0000000000000001978081cf77074c45ef88a28d0610d17f5fec5a7bdfb49274d2477592d256eb50455bb860dad5000000"], 0x6c}, 0x1, 0x0, 0x0, 0x400e090}, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r1, 0xc00464c9, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0xe4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000000)={@host}) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xbc, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x6a) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c0000000102ef7b531e857dff0300000000000000000300000508000540000000030e0006007369702d32303030300000000600074000040500080008400000000108000840000000002000028006000340000100000a610340000000000c000280050018b6010000007fa50401c5fd78da26f46e0c5563b81e70e3bc173be24723790fedd74b03cbc903146e6533db9687f8ba18e2c0e1444535d36d7d5af4529ff233882ed784d206d646e6d71f258c0300000000000000071158ba5f8370c3baf658a1cee689da505ea1bd7131c9880229ef9d546294d8297d8a5a1dac1ba172e14e938ad2fb5a4395690947fd366a83372d84280af9d6e40c4c9bb9b59f77ab0000000000000001978081cf77074c45ef88a28d0610d17f5fec5a7bdfb49274d2477592d256eb50455bb860dad5000000"], 0x6c}, 0x1, 0x0, 0x0, 0x400e090}, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r1, 0xc00464c9, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:04 executing program 5: socket(0x26, 0x5, 0x210) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 00:50:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 494.454731] binder: 1171:1174 ioctl c0306201 0 returned -14 00:50:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xa8, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x44, 0x0, &(0x7f0000001500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x74, 0x0, &(0x7f0000001600)="85a8a862728b5a427de852ff6e273fd73f2ee33bdff0e2832f05ce35ee0a5cc7d12a7fe6ed50efd1732e5ca42b6f71c9b0c37154701809a55d4041320dc6510243bce1200e05e812e8504f3e5123484f4ce00de2143caf9a9ee585db60dabb945adbed3cb53b6490a212afef6b4f8e12df5e94d9"}) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:05 executing program 5: socket(0x26, 0x5, 0x210) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x5c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 494.561068] binder: 1187:1191 ioctl c0306201 0 returned -14 00:50:05 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:05 executing program 5: socket(0x26, 0x5, 0x210) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x10, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:05 executing program 0: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x67, 0x84, 0xf8, 0x2, 0x0, 0x9, 0x1000, 0x8, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xffffffff, 0x4, @perf_config_ext={0x4, 0x7}, 0x100, 0x81, 0x10001, 0x2, 0x8001, 0x0, 0x3f}, r0, 0x0, r1, 0x4) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) [ 494.670137] binder: 1204:1208 ioctl c0306201 0 returned -14 00:50:05 executing program 5: socket(0x26, 0x5, 0x210) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:05 executing program 0: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x67, 0x84, 0xf8, 0x2, 0x0, 0x9, 0x1000, 0x8, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xffffffff, 0x4, @perf_config_ext={0x4, 0x7}, 0x100, 0x81, 0x10001, 0x2, 0x8001, 0x0, 0x3f}, r0, 0x0, r1, 0x4) 00:50:05 executing program 5: socket(0x0, 0x5, 0x210) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 0: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x67, 0x84, 0xf8, 0x2, 0x0, 0x9, 0x1000, 0x8, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xffffffff, 0x4, @perf_config_ext={0x4, 0x7}, 0x100, 0x81, 0x10001, 0x2, 0x8001, 0x0, 0x3f}, r0, 0x0, r1, 0x4) 00:50:05 executing program 5: socket(0x0, 0x5, 0x210) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 0: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 5: socket(0x0, 0x5, 0x210) 00:50:05 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) 00:50:05 executing program 5: socket(0x26, 0x0, 0x210) 00:50:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:05 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xbc, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:05 executing program 5: socket(0x26, 0x0, 0x210) 00:50:05 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) 00:50:05 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xa8, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 5: socket(0x26, 0x0, 0x210) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:05 executing program 1: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 5: socket(0x26, 0x5, 0x0) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:05 executing program 1: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x5c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 5: socket(0x26, 0x5, 0x0) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:05 executing program 1: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r2, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x0, 0x80, 0x0, 0x4, 0x0, 0x248e, 0x8200, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x5, 0x2, @perf_bp={&(0x7f0000000080), 0x6}, 0x8066, 0x80, 0x7f, 0x5, 0x1ff, 0x200}, r0, 0xe, r4, 0x0) 00:50:05 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:05 executing program 5: socket(0x26, 0x5, 0x0) 00:50:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x10, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:05 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:05 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:05 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:06 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 5: socket(0x26, 0x5, 0x0) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 5: socket(0x26, 0x5, 0x0) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 0: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x4, 0x0, &(0x7f0000000640)=[@enter_looper], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 5: socket(0x26, 0x5, 0x0) 00:50:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r1, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 5: socket(0x0, 0x5, 0x0) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 5: socket(0x0, 0x5, 0x0) 00:50:06 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) [ 495.954322] binder: 1398:1403 ioctl c0306201 0 returned -14 00:50:06 executing program 2: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) socketpair(0x9, 0x80000, 0x8000, &(0x7f0000000140)={0xffffffffffffffff}) connect$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0x8, @empty, 0xffffffe0, 0x1}, 0x20) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 5: socket(0x0, 0x5, 0x0) [ 496.056739] binder: 1418:1421 ioctl c0306201 0 returned -14 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x5c, 0x0, &(0x7f0000001500)=[@register_looper, @increfs_done={0x40106308, 0x1}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x74, 0x0, &(0x7f0000001600)="85a8a862728b5a427de852ff6e273fd73f2ee33bdff0e2832f05ce35ee0a5cc7d12a7fe6ed50efd1732e5ca42b6f71c9b0c37154701809a55d4041320dc6510243bce1200e05e812e8504f3e5123484f4ce00de2143caf9a9ee585db60dabb945adbed3cb53b6490a212afef6b4f8e12df5e94d9"}) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 1: openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 5: socket(0x26, 0x0, 0x0) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 496.156702] binder: 1434:1438 ioctl c0306201 0 returned -14 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) 00:50:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x7c, 0x0, &(0x7f0000001500)=[@register_looper, @increfs_done={0x40106308, 0x1}, @register_looper, @decrefs={0x40046307, 0x1}, @acquire_done={0x40106309, 0x3}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x74, 0x0, &(0x7f0000001600)="85a8a862728b5a427de852ff6e273fd73f2ee33bdff0e2832f05ce35ee0a5cc7d12a7fe6ed50efd1732e5ca42b6f71c9b0c37154701809a55d4041320dc6510243bce1200e05e812e8504f3e5123484f4ce00de2143caf9a9ee585db60dabb945adbed3cb53b6490a212afef6b4f8e12df5e94d9"}) 00:50:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 5: socket(0x26, 0x0, 0x0) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) 00:50:06 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:06 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:06 executing program 2 (fault-call:1 fault-nth:0): r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:06 executing program 5: socket(0x26, 0x0, 0x0) 00:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 496.386062] FAULT_INJECTION: forcing a failure. [ 496.386062] name failslab, interval 1, probability 0, space 0, times 0 [ 496.410951] CPU: 0 PID: 1473 Comm: syz-executor.2 Not tainted 4.14.230-syzkaller #0 [ 496.418773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 496.428132] Call Trace: [ 496.430725] dump_stack+0x1b2/0x281 [ 496.434360] should_fail.cold+0x10a/0x149 [ 496.438516] should_failslab+0xd6/0x130 [ 496.442525] kmem_cache_alloc_trace+0x29a/0x3d0 [ 496.447291] binder_get_thread+0x1a9/0x830 [ 496.451534] binder_ioctl+0x170/0xf80 [ 496.455340] ? binder_ioctl_write_read+0x7b0/0x7b0 [ 496.460275] ? trace_hardirqs_on+0x10/0x10 [ 496.464515] ? fsnotify+0x974/0x11b0 [ 496.468230] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 496.473160] ? debug_check_no_obj_freed+0x2c0/0x680 [ 496.478177] ? SyS_write+0x1b7/0x210 [ 496.481893] ? binder_ioctl_write_read+0x7b0/0x7b0 [ 496.486825] do_vfs_ioctl+0x75a/0xff0 [ 496.490630] ? ioctl_preallocate+0x1a0/0x1a0 [ 496.495036] ? lock_downgrade+0x740/0x740 [ 496.499189] ? __fget+0x225/0x360 [ 496.502649] ? do_vfs_ioctl+0xff0/0xff0 [ 496.506750] ? security_file_ioctl+0x83/0xb0 [ 496.511163] SyS_ioctl+0x7f/0xb0 [ 496.514528] ? do_vfs_ioctl+0xff0/0xff0 [ 496.518509] do_syscall_64+0x1d5/0x640 [ 496.522410] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 496.527635] RIP: 0033:0x466459 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x78, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}, @request_death={0x400c630e, 0x2}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:07 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 5 (fault-call:0 fault-nth:0): socket(0x26, 0x5, 0x0) [ 496.530826] RSP: 002b:00007f1491840188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 496.538635] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 496.545900] RDX: 0000000020000800 RSI: 00000000c0306201 RDI: 0000000000000003 [ 496.553168] RBP: 00007f14918401d0 R08: 0000000000000000 R09: 0000000000000000 [ 496.560436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.567719] R13: 00007ffd0af70d2f R14: 00007f1491840300 R15: 0000000000022000 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x1}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:07 executing program 2 (fault-call:1 fault-nth:1): r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:07 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) [ 496.628622] binder: 1468:1473 ioctl c0306201 20000800 returned -12 [ 496.656096] FAULT_INJECTION: forcing a failure. [ 496.656096] name failslab, interval 1, probability 0, space 0, times 0 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) [ 496.728407] CPU: 0 PID: 1496 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 496.736240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 496.745603] Call Trace: [ 496.748200] dump_stack+0x1b2/0x281 [ 496.751851] should_fail.cold+0x10a/0x149 [ 496.756014] should_failslab+0xd6/0x130 [ 496.760023] kmem_cache_alloc+0x28e/0x3c0 [ 496.764204] ? sock_destroy_inode+0x60/0x60 [ 496.768534] sock_alloc_inode+0x19/0x250 [ 496.772610] ? sock_destroy_inode+0x60/0x60 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) [ 496.776956] alloc_inode+0x5d/0x170 [ 496.780597] new_inode_pseudo+0x14/0xe0 [ 496.784590] sock_alloc+0x3c/0x270 [ 496.788144] __sock_create+0x8a/0x620 [ 496.791962] SyS_socket+0xd1/0x1b0 [ 496.795515] ? move_addr_to_kernel+0x60/0x60 [ 496.799934] ? __do_page_fault+0x159/0xad0 [ 496.804183] ? do_syscall_64+0x4c/0x640 [ 496.808176] ? move_addr_to_kernel+0x60/0x60 [ 496.812605] do_syscall_64+0x1d5/0x640 [ 496.816514] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 496.821709] RIP: 0033:0x466459 00:50:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00\x00 ', @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) [ 496.825077] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 496.832908] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 496.840194] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 496.847480] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 496.854850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.862127] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 496.887732] socket: no more sockets 00:50:07 executing program 5 (fault-call:0 fault-nth:1): socket(0x26, 0x5, 0x0) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 496.912906] binder: 1514:1515 unknown command 536870912 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 496.961139] FAULT_INJECTION: forcing a failure. [ 496.961139] name failslab, interval 1, probability 0, space 0, times 0 [ 496.989618] binder: 1514:1515 ioctl c0306201 20000800 returned -22 [ 497.053171] CPU: 1 PID: 1526 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 497.061031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 497.070390] Call Trace: [ 497.072984] dump_stack+0x1b2/0x281 [ 497.076641] should_fail.cold+0x10a/0x149 [ 497.080793] should_failslab+0xd6/0x130 [ 497.084775] kmem_cache_alloc_trace+0x29a/0x3d0 [ 497.089448] ? kmem_cache_alloc+0x35f/0x3c0 [ 497.093767] sock_alloc_inode+0x5f/0x250 [ 497.097808] ? sock_destroy_inode+0x60/0x60 [ 497.102121] alloc_inode+0x5d/0x170 [ 497.105755] new_inode_pseudo+0x14/0xe0 [ 497.109743] sock_alloc+0x3c/0x270 [ 497.113264] __sock_create+0x8a/0x620 [ 497.117244] SyS_socket+0xd1/0x1b0 [ 497.120779] ? move_addr_to_kernel+0x60/0x60 [ 497.125193] ? __do_page_fault+0x159/0xad0 [ 497.129436] ? do_syscall_64+0x4c/0x640 [ 497.133394] ? move_addr_to_kernel+0x60/0x60 [ 497.137829] do_syscall_64+0x1d5/0x640 [ 497.141718] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 497.146907] RIP: 0033:0x466459 00:50:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x4000) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0xe5e88b2a94d81fe2, 0x0) ioctl$UI_DEV_DESTROY(r2, 0x5502) 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x6800) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x6800) [ 497.150092] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 497.157780] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 497.165034] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 497.172294] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 497.179570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.186833] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 [ 497.247475] socket: no more sockets 00:50:07 executing program 5 (fault-call:0 fault-nth:2): socket(0x26, 0x5, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000200)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x0, &(0x7f0000000840)=""/4096, 0x1000, 0x2, 0x27}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/189, 0xbd, 0x0, 0xf}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/88, 0x58, 0x0, 0x10}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}, @exit_looper, @acquire={0x40046305, 0x2}, @release={0x40046306, 0x1}], 0x1000, 0x0, &(0x7f0000001840)="fa21abb796b699052018b5282bf475d1f24e8c4480247429bba36a7f746381dcef02bb9d648b082b4d36dd109f3703eeaaf969a1d8234e8c0177e89b9e41fa4ac0dd8401884cb972f26c88df34551cb85d91a12d1df31c493c62d124bb3b00311db419dae039d39cbc29e0d835d1b83111299c0f91b35d4629f45da2b970a40525e01745f521e5aa6afa84b82eabae9dac6632b93d870a653c720c9fb1e42cb6eeae7a0be17871f864db4fe8ffbaba05144740b8ae4579aa8c730c6ac78527fea5342dc8e606877d7560be0e60c1d1b860a54d3622e4cc733e63ccc02b59b395a8b35219de7d7f5389604620f6e5a0736963a61e70d425f2bc7a46b28bd45b81a30528647779bbb0d9ab90caf34ff8487a06ce3f09ec2538be8b15285918aa607fd22593c5a393c7060a539ff34bf6135d5e4d8730b6fde6fe555d17a9038282b69385343c36fe8090901d5a4253b251b63a6616845014213cd3e7585901d9525988425d41f1f1cb961dae926212da9448111c0ddff8231c0dbb1f35c2f8638bab50b9765d0974235dcd2568ffb38471cddc0821d399ea6fb76312e478b4b0418a34539ebbdcda4e3f5bcfd07c6d4ab2142ce41d46f69e10c17505a727e362bc5a58b51c4a3c1e99ddd948e4bff25fd082f0881eba5a98fe59fb40e178e3ba61fb5e03d7fac9b53bc3ff1fd67d5033976725718c82129a988c12ede47a5d275a4afa164f936f6daa99fc06d2adda1624381f02430280a493bf6713803f8db74ed36b8b8c6d6ae7def9ce1257e7fbcd8d7a4dc9ba38593d21be1e6aac3de113485f9a5465029b4b272f75204e7ddad44e3733f04e896d44b0e8ffd94f7e3798ad7262f2fdcd1e553539f2fb134dced3cca1e6cdc282b61aac6f009c22f5e4eec99703af8198e7237052ebccbf6dc6e70d8414f1919aac96759b4568c4aafafd454f52de916e8d0cdddb3f424639946d0dd22b627091d72516b111808b0c7d9f67672d07c4571a935a3aa14e3b79df1474e5f76747cfa783488d3a7b025464f785b099357d3f9f0502f9deb36f8c268066c82e18405f042ff1adcf9ed1bba9072145e1305304f30bfe73dbfbec9f35633ca18ab3c4950d19f91da667ce58d5d8bc5965e8e84989fd19f37d767441104517f320a1ad703ade2541c68e3eb09b917640cd67a837b8adc681043f6091de547cab06b9c439278d08a17528ac22d95b77535f9867c7451d1e5b78c9cd9f778012b441a1fce9f25614c14f1b542bf82f529ec7799266167d20b7c2a0906eecf74c28e48be03896ce22c6af0275c2f0489da10a482ec7982d2705b8a0aa175d4bb47fb56963e183ae49b0c3989c4813e7c6961489a46182a3bb3460a3e39ee611e879843be7bc7a36a1165ad71134dc6bbfc49f6dc55143cbe015b3a37bb6d8d6c462b9bb09172a0fbc660bc22c233c680a9a1bccd41d39536f4d7da01a3e055c1b4e29ff774aa304cc74798322cf01f1bd9456a6fe01b4a6f7d3668a27c0b7a55aace284a242e1885715345fee57fb724176f6f89b772675a124619d0b8ee432f99bb25aeabbd25139d96fe8babeb8389f77c1554d34a7d22705a747d68639fe949755a39ae86cd8dc866ef9085b56c5537e3fce0e66d0d050e2d4a60350f985aaa06782b2eca3373b3f216edd71813457e67c498e7b84bdfe97e7fe804f963e7fd19158d29b0c481526de081ee2b00abe1672b2368137b9e83bacd6e66b1bdf89ac63d70b5a7b2f12bcd18399c78cb0a9eb2905d3cfe0eb888ce31944d71be9efd4b5300772e7b866267e784d75b31d2517404a29962407eafca852fbc1904a3a36fd8b5eac42500480ce09ac98de6dc34856ee5692ddfe3e6dc2b5fc02e375d7b4fc9e76a584fc34324f69df8bb73d55f4e260c34248e48235c8a3eb15d7623b6f8f3757a0a7172371c23258b5950578dbcc055fdec6d0c415d45b87ef21f5d92a2b86eb5a4da0f0cd6c76a0ab5ff558fa7f3eed24e685cc5afce23a19a16db9741fed3e4945f611167112579ee26fc6770710ba6b996ab9407f82ffbbc6fee05d9f4183b5088c5f73bf932059ab0e92df6af92017b82ba48eefaca79563c2bf00b76e9c28d84c7a38560101de9b6e7d5125f53e22d89ce6d45d61f185bed9d88e77093e699d02b1388f58db341fb98af91de3f8a09f0ebe1fc6288faac0689ddb80a32cad456db8ae95459b0ea856e04ebfa1ece14ffe846423b1a793aac6e747833eabd1c87f159844d3e9d86da3397622c2efb9706411e7d5ca1fb7627c9f0eafeb77ee51044a8ef7f5c7287de2fc563c635491f31765a011dd715e12b154a1da434f02e292453e98f62b89e1df8a30d129879f004574565893365750b9a13a7e2280cfad3d9b00b9eb39368ce2e3b06cbb6465bee61a73b37ca13bd1db0b78d1f2cb8cbcd34329283941b8f46675a2b3ed752a872f9106bb951a59583fa5e88205e18cf095b21287f807fe5bb641fecec6d56df8292e4fde5a51fa63450ee5d3d8e1e15a13dc08433bd373ba16bf55d70584c2279b9a993710a872739e8b1c52f07f05e9b4349c28e50b3fb57f7e0f8eb72563662ea964847bb0b7ed32034326cbfb681061bb56e7bc78344353b2104d570d8cbc510cf8b189ab05c25c78efa72a34d672d78a8f5f233fd3d58893df59d9829bf53c01f3e1f2b65772b818fae29b0f97e1f89833aabd7650cbd6faab9031d52d01200008f395f80ffeb89486ce47ce0b9b3477c3c0371fee95a5ae839a4264c9b32f7364a3a5011198c75272e7c45c0c7ce157dda60c32364149b6d77e31d0915d81e81884b02962adcd90a0289e47c3cb77fdfe7d5b41794fb0392526702ac812bcf0aef5c112a86b142b61eb0d0f1a630a40a06135f8346a29bd16f58d437b4c13545b8a43f69a719a735f965bbb8d4e860f592d576a5380057df616720837318e432449d07a6e02747f367e2adffdafe166006586594c256b83293964edd305f73619b7d942370d1be12a198bc1aa8e6e8a9b508dbecabf4d5695d39fcbd3e530f650b8efce003b736314828586c709aeeb96387c015fae5206d89bcf7c5f96665cbbe451512016b31e7de93b039eac16b844dcdd6e66b3382fb648be013f6fad1c4c8ddfef826a34b45d6f1230b6cdfebe6a596acd7ef4951e8fd63c564f24e18269bb176a44e895eb911bce33b224a2c0810eb0390a4237fe62c9af3d47083fce5692b3b39133f0eab847a73fd705adbca99a2ef79f8b4fc5981c5072ce017d7df31d0270ca0f75a28e08c019004e8f3c7c94cbfbea00e63c274c0c8542bce08dcbef47b1c29325ed00fbf7fff8cde3a0ca1d51ced62543734dfc5397d827de30455ab781bd91335157011a4548e7e1ff79548b4cfd4ecd71b92f9e4de8462807c1acf8ff31694a69a88652a5b5881acd1e36c42e847fb983f2cba8e9edf6b2137011e933ef91b1962ca496378dc051bc44785d859473c9c36bd5f6c7bff0b80e6ace87e330c32b28d6e07d947316fa3c7c70ccb2c50afe130d37f1ae26f3cff19f5d0fc23f370d8f002ae5d33747bc152c273167361ae2417bc3f1fb35d224aab41607bf37c3d6becdaa98bbd87c7f028e8eb1a14837e17485faab70f3077811604e9b409067ddc2ac5d785cefaf595b24004f39b114c64d21c0d852768137a8c12cbd2ea9b8918765c594cf51babade0a2731c10072cd4b137025bf12b4bd92958c30f939ea51a45e5b0c6efbe2677e927a53ecebe74e4946e54596925c3b3c89bc4b25bd98c22d0714ea2b9c6f56823519164c8036e7417f1b8e8ad643cb3e16eeb03231f9ffef011caaa599ce5cb379f76b35585b15dacf90926a3d84f76b741ebb9593b055f3dcf796a1562e7a545ef78c51a27d19c1fb76ab507aa30d4af56b3ecded386e129693bdb9b7d4de65291b5f6e71923de52acfa7446a9ea478fa7e78517ee9395f2ab7c68fa84b8b698791856d7270f38c078babd72b8598cc8f6e7d340c7deb3fe4972a623ef1c5e36bcb1c1a3425856d98e9b3c880d132c2173b6a942147ff5768eff38a761942b8b67265c870e1b7f3511403dbd890891071bedac2f5f15c8592bab0fdc5bf71672cc483cf8589b0e9c1aecddb7078605a9c94eb1dfb618add5107fe45e52198b8d055b83625a4d4e97914992de77cfc21727dcad8dfa623e73c771a8657b9e4955c67bc8758746c4dec55b483cc78ffa10d307829c78cac6ddcead6da521e8470bf006ab8e460210e237a457fe87e363c0057f7bdbbede7c2474d1b60d994712b81b99ac24da7bc60de3e7caaaf6ae84f76134f4e0022296a8ac1073405bc5be9f058040cc548aca435217f86806059f5370e74b5309e98c96c84201fee25c2143c5c20423e0a90f977d54551560de265417a8e5c5141b485987ebdeb103de65ee948a3a0af03897b1a5aeb285d9bc4f6cfbe319d8c46a0859de9d0dc575793189e236023f9d766e27f3e2aa3043ed1d2b6c8051437634b5d463a0bbc8ac9d4845bebce9d31c1aeab9d295a75c71cca5ae58e8362efb72b3aaf0ee4ebe7a25b0748a33ecb4aacf1375862372d3b154c79218d61f672a919caa8f9c4af6533f7911c601c641015d6f252218168368e5a0e2d0a252850a68d29230da5e1ee3e016b5517a477f3a22e67ded6d8f1a3a4d3871a31eccbbb4c97be7d89e416790c1d6146e249a8a916fdf9fb1c2b44b9fc27d007aced97bd1b3b899ccbc3d5b4fab5b8ecc36017334a5f943f18d59ac3fb70b8807b2a0e7bac1c278c348ffd2634720c80a0e9ffef8f27df553fc32789b4b5e0dd629a228ae863b432e0ea9374e8044b87542ca40e7fd2a71149c1fb61f02422861c576ca0e4174a79aaa06895ca213c9ed2e23939bcd0e346f9038c8dbd8cebc0c57ff0e53119179b91b4d18e09d580cc4b57f444a6aa7d4fb2e9bc7b71b2ccc5236534bda73283f1095ffdecad7c783ea55de77f2292db7875d43428c68e9326087e18c69bf228fa5166668acf462b63e6414bcc258f073dbd3b8d5eeb6073e820ef831d178a6bdff95c2fab873a2fefd6b94440289a8313310cb18e78ae2b92be0b10345583dae3d2f77d633d6de6d07265d1f8de2a5f04e14bac54eb36b610e4801b041b0da7e25b79ae2f3427f1721a3e77b6370dfb6609df3e680e83e920cfefea2218f9b1a05c74c8e3e59da538e16f606a378d99d6b1666af4cddd3b59fc0a5d43a6493f2c3268b0202405617fa75f957631dd8e20bffbf675772f63b72c2f347bee42686103e413c9731b763464662ef46eac337186ba116c52ffa43ffee8e33ae42c48661f8e41130e8951ef25475f0c2389b1c11cac643bbe7f324043b9944aca7fd91584325ffdfd4ae97ef4a5b0da7547905254c62e82542a2cbae7493002f8603e1521a8232fbaf2a81727ec3a300f4ee2cd17269844f7015cbc51cd2bee5af2427dd8e171e58509cb8caf231c250a48d6fb653a2e0bbd4b9bf1f59ab67786084d6caac339ea55578ccdb45c74bd3382eb7dba4d1d5302bc41235ee6fac44df68a844b1f594b856fc9cb697898012011f5cecba12ec50ab5a55226792c7ba6c0296499861b64aa86caffba133ea7a23b895802cd2bac90dd85dca9b6da4293596ac3afbd222be884b003a12c1ec3a2cd97a7242b6ec77e54f8d8cf86f0175723df145b1a2ef9709e87f96ba3f6630d8c3e92281af03237310f6d4791e843236e035c6285412e5dfb1e05237df3501aadc5d31810c01c89e90aaffee58be1f38ce2210625553757d5f77711db8dd7ad75af"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000280)=@migrate={0x37c, 0x21, 0x800, 0x70bd25, 0x25dfdbff, {{@in=@multicast1, @in=@broadcast, 0x4e22, 0x1f, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, 0x0, 0x1}, [@migrate={0xe8, 0x11, [{@in6=@loopback, @in=@broadcast, @in6=@mcast2, @in6=@remote, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in6=@local, @in=@private=0xa010101, @in=@multicast1, @in=@loopback, 0x0, 0x2, 0x0, 0x3501, 0xa, 0x2}, {@in=@loopback, @in=@local, @in6=@loopback, @in=@multicast2, 0x3c, 0x2, 0x0, 0x3507, 0xa, 0xa}]}, @mark={0xc, 0x15, {0x350759, 0x800}}, @mark={0xc, 0x15, {0x35075b, 0xfffffffd}}, @algo_comp={0x8b, 0x3, {{'deflate\x00'}, 0x218, "61989dac6d55cb91737468af368e8a036f82b9ffdfdfd57498058161aa22f96ae83517de034e5e6369347f2fd9b995d8608acb39f35968df29af81a6239bf7d42d86e3"}}, @address_filter={0x28, 0x1a, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast2, 0xa, 0x1}}, @algo_crypt={0x102, 0x2, {{'xts-aes-ce\x00'}, 0x5d0, "9de6235b1857067a30eac4d5668aeafe947ad883f971a333410acba4d0b3a5c0bc5ff820f800b6a35e0d9ba1f4be84c9a614e74b8a1993cabd7435680cdb07c58ab5fd7971da399aaf42da056f062b135a9107fe6dd44ebb06df080d63742f79a59c5c6c967a9eb51e58d58c4146d79efe1e6c082e356bf86bf8d0b305889aa5c2e8023d3a400382adba3f3aef31f9bd1bbb94a1b7610feac4bb161b019b21b828df7d62ba929955647c41ef5014ba46c089873bb4a8ab9861eb"}}, @algo_auth_trunc={0x6a, 0x14, {{'sha3-512\x00'}, 0xf0, 0xc0, "8b65307fc0f7eae98bbbcc8ec63c061baad9f36ae6c9c9fb2465d44aade8"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x6}]}, 0x37c}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046205, &(0x7f0000000080)=0x10001) syz_open_dev$ptys(0xc, 0x3, 0x1) syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) socketpair(0x1e, 0x0, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)) syz_open_dev$ptys(0xc, 0x3, 0x1) r4 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1, 0x11, r4, 0x2) 00:50:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00\x00 ', @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 497.346875] FAULT_INJECTION: forcing a failure. [ 497.346875] name failslab, interval 1, probability 0, space 0, times 0 [ 497.417713] CPU: 1 PID: 1572 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 497.425549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 497.434912] Call Trace: [ 497.437509] dump_stack+0x1b2/0x281 [ 497.440615] binder: 1585:1589 unknown command 536870912 [ 497.441138] should_fail.cold+0x10a/0x149 [ 497.450660] should_failslab+0xd6/0x130 [ 497.454664] __kmalloc+0x2c1/0x400 [ 497.457843] binder: 1585:1589 ioctl c0306201 20000800 returned -22 [ 497.458207] ? sk_prot_alloc+0x1ba/0x290 [ 497.468608] sk_prot_alloc+0x1ba/0x290 [ 497.472501] sk_alloc+0x36/0xcd0 [ 497.475870] ? lock_downgrade+0x740/0x740 [ 497.480023] alg_create+0x7d/0x160 [ 497.483654] __sock_create+0x303/0x620 [ 497.487542] SyS_socket+0xd1/0x1b0 [ 497.491081] ? move_addr_to_kernel+0x60/0x60 [ 497.495490] ? __do_page_fault+0x159/0xad0 [ 497.499725] ? do_syscall_64+0x4c/0x640 [ 497.503693] ? move_addr_to_kernel+0x60/0x60 [ 497.508099] do_syscall_64+0x1d5/0x640 [ 497.511991] entry_SYSCALL_64_after_hwframe+0x46/0xbb 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:07 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 497.517180] RIP: 0033:0x466459 [ 497.520395] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 497.528104] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 497.536326] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 497.543592] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 497.550856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.558132] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 00:50:08 executing program 5 (fault-call:0 fault-nth:3): socket(0x26, 0x5, 0x0) 00:50:08 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/115, 0x73, 0x2, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3a}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000100)={0x0, 0x28, 0x48}}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 2: r0 = socket(0xb, 0x80000, 0x2) bind$can_raw(r0, &(0x7f0000000000), 0x10) r1 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 00:50:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046205, &(0x7f0000000080)=0x10001) syz_open_dev$ptys(0xc, 0x3, 0x1) syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) socketpair(0x1e, 0x0, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)) syz_open_dev$ptys(0xc, 0x3, 0x1) r4 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1, 0x11, r4, 0x2) 00:50:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x0, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) fcntl$getown(r0, 0x9) [ 497.646665] FAULT_INJECTION: forcing a failure. [ 497.646665] name failslab, interval 1, probability 0, space 0, times 0 [ 497.717459] CPU: 1 PID: 1609 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 497.725280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 497.734722] Call Trace: [ 497.737320] dump_stack+0x1b2/0x281 [ 497.740950] should_fail.cold+0x10a/0x149 [ 497.745104] should_failslab+0xd6/0x130 [ 497.749374] kmem_cache_alloc+0x28e/0x3c0 [ 497.753527] __d_alloc+0x2a/0xa20 [ 497.757007] sock_alloc_file+0xc8/0x2e0 [ 497.760989] ? sock_poll+0x220/0x220 [ 497.764712] SyS_socket+0x108/0x1b0 [ 497.768338] ? move_addr_to_kernel+0x60/0x60 [ 497.772837] ? __do_page_fault+0x159/0xad0 [ 497.777247] ? do_syscall_64+0x4c/0x640 [ 497.781218] ? move_addr_to_kernel+0x60/0x60 [ 497.785633] do_syscall_64+0x1d5/0x640 [ 497.789525] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 497.794740] RIP: 0033:0x466459 [ 497.797934] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 497.805647] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 00:50:08 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x5, 0x8b, 0x2, 0xbb, 0x0, 0x0, 0xf2d00, 0x6, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000080), 0xa}, 0x1, 0x9b9, 0xffff, 0x0, 0xd14, 0x81, 0x81}, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000001480)={0xffffffffffffffff}, 0x4000) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000001840)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001800)={&(0x7f0000001500)={0x2c8, 0x1, 0x2, 0x0, 0x0, 0x0, {0x0, 0x0, 0x2}, [@CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x8}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xbc86}, @CTA_EXPECT_NAT={0x21c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @private=0xa010102}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_TUPLE={0x54, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_TUPLE={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={[], [], @remote}}, {0x14, 0x4, @remote}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, [], 0x1}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_MASK={0x5c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_FLAGS={0x8}]}, 0x2c8}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r4, 0x0, 0x0) r5 = perf_event_open$cgroup(&(0x7f0000000300)={0x5, 0x70, 0x5, 0x3, 0x5, 0x6, 0x0, 0x2, 0x1010, 0x9, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x7fff, 0x2, @perf_config_ext={0xffffffffffff8001, 0x2}, 0x6000, 0x8, 0x2, 0x5, 0x9, 0x10001, 0xffff}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x4) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) io_submit(0x0, 0x4, &(0x7f0000001440)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x1, r0, &(0x7f0000000000)="9960cbf9ed312c15318b5cff2b02c2eb5f8b7a7c395d8ba7361244323062650d", 0x20, 0x100, 0x0, 0x1, r1}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x6, 0x0, r2, &(0x7f0000000140)="0ebc9882d4181ea03a0d2a396e1ed2d75fa77c5edaef9908cbe5535ca51086b6612b00cd6a4e0c418b7e9a2bd2bce9c1cf2b0c6918ad3d380e4a78a94fca07679e48f73bdc1c33786d09be287946d883d172678d0e08affebf30cb73e6f9d9ea3cf8aebed111cbc478664f24f777a163d5048f0620649b2c6a6dc2a86fda4aab49aeaa7e71bb3d4340abb1cd55fe00f44ecfb74ea6eea6453a0e2157c3333eda61967c4b46759af9717275a38664068bfaa6b8588e1ad73fe735055c8c135ba974b93199d95d62fb8d0fb886138e8935bbfb0f1608c80de26c69861df9b536e66a2c7fe6833cc39d9c2d", 0xea, 0x1000, 0x0, 0x0, r4}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x3f, r5, &(0x7f0000000280)="23d9738b355d3d82c678a6ccd25c2c036efa3ed530", 0x15, 0x6, 0x0, 0x3}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x3, 0x4, r6, &(0x7f0000000400)="e57786db86a697732ff3fcca69ed2aa183f09431c6aa57509b7043958f25632cfd12354e5a174ed30298d77da96df4e486414c30784f622d4cfa812e937a05c92533040d4c8078eec78eb1b369ee58bd385474f0adee6af85ad8624d9708eb772578f61c1e60fbc0235a8ce6108ac72d88e2abdb45827bfb60c2bf42442ac2b74c0e62b89284f4dc61a4b9fcac67aa2fc2359aaf13231bcb671e980757e9ae9c19bb161900d7b4d684f30af74ae07f292e816e3e57e6f97946cb37d9dd991055110989a129cf2501c2f4514ac70aaabb85bbb04e4e5c7d74e538ab018d92e243c683a4d46fc145e9181b8e78c8dc1004f9696bf2397c05d582a26b780661768037335ff79f30ccde280f623c7856f5adb21a8f82091e40b5420c793a6db9512a487fbf5167913fe097cbf87f7bbc760363309ea929dfab37532791556dee40a688f94f5870a3c2d94af6fcd3ed94e6a29713ccc15246d1e6a23d78f22c09651fdb6d5fac157a8c90da6cd2b45cd2470e330ac0ef24f8a3a0a5aa64de82deb8d1ac60668e24e138ced4450ffe431abebff9a2704b49e165228157693fa35432014ffa7e7211232130c311a8dfb79765a337ca2c9a9bcd148335de605a3a586004c51b42bd2dfe0b3661cfc385bee557f933578e7a99d07a47c21d4313b2698ec73345f326b4f9ed0d732fee65470c918b8d302771cff9f90b34852fdf3e6ad1caac9f198581c00bc5848c8baa11a9b9068bf17234ad714dc254b54150c9be6b188726a5c4e046a1062ee8d94b979abcc0248754efed3d0f1a8002aaae4e91664aa396aa6e3eef678a919dd23d07231c11e0bf4eb864ab96951f2163d1216434cc1a1dee5268eaba00da9e07e2e056aae90f6f9e25566ccb27011e0262d9bfff442168591a0772cca6397d270e4c76c33f13f990dedd870e85c85574a37948e3e3f3fdafbccbc2d02cb1320ad22dfb126a56c4eb2b617b1b7c08265e40e8a30e8b1c2ee74bfb968d38dec1c570e40286e9e670f7873fa8f96cf9211108af809da407951020fe8dacdbeb7c1aef7b5c9951fccdf5064acfc5552c0b36464ef6a8aa46a34a284984d07dff3f7d79c0be94004c1bdd716b7b395190bb65684422feca0f15929c03d3720fb7a5ff095a7379f1d33774f4215dbb873fdae966dd7ade8343c85bc4b0322627350e7a728a5e955fb30e88e4eb43c5ea2dfc15d89f7ea3544540b6eee9318abea4825ddb271612e7e7a99ff770a89ffd0c53d9759b3280f368cfc106b6954d63f3f99d7d1e50c36275bf1182f9b2aa1fcdcbd395fc8d1d4b3863510082a060597cc52862375feb7af7bfbf02039da9726a2a2436db931bedd7b57000a6ed0cf6e9dbdaba132fb14296dc1d0c439e3733e342a0474f9dd333494dfe1c697877ceb2082054226e40964677e0590263b02d3354bbbd44ad5ee94c7a4006296cff8866d5ebeeddb49ae075733ee5f55e07055c5f99b7d220c3591c8ed90a6f77b29b215341234e9b1b32229e8f2c6c7e1a352dfab9b173e93aac36c75e28ed0e6a2eb62d3f31726f066bb36b3a2bbea93e5bac64eeb9dd5c2841ffcd9309a4f6084976b8a7278259842f45b874645f36f3de74e6d22699932f990d8d6e7f3e12aecee5e69f700f58f2a57abdbfae43c6b0ce659da7eb0e859a66f81f2e5072603d3cbd9f08dab8189ffe0b871bb5ac1835807adf9649c66b2c0597e51127ecbe9d8311710d058d857c2b5d76dbc76d71150d14ec3db47a1274d3aaeff6247f104470b00a50ecbe12dce72cda2bdca378fe402326ab999d06523393f534ac1cd290625f3d27e9b95718b5ad37a6a18145e808afc415d391ec3fb60e5cbe397b8296e5c621d07eba580aaac9141519b369e4abbd325cf0a4eb3f23c832bf8eba185a06b147e9340e0c3b377a2ccda8f7b2639739ed748d281b194c0ffe9384af8e273d9b2addae78715c755ddc3eff85de489905db21eb4981249445d8547737d146aa8374ef2d9a128503d082818fddf999eda8cf4c7cebeedc366ed6826fe16aede5dce0103249a3e54d7581041993374a6a39d378a8585c6de53ec27504e636d7da02d7bbbe60d85313ae37dd82cf8cbbaad6eae6a8370e79e4fa1e7c925dbbd50806b1695c043d75ea92bc72f0d72a2f123c83a04d7adb5e154a7edbae7c04d17a054c88e2f9898149f353f7384ac545fa8c8474027cd444f06a1e374c8e8d3bd2e3897f2802432fd6932b6902d7b3b579286669201b8e8b53f7c8307f912a3796b4dd877f5fe581859ba88cc1f16a468d5b6d052de26df587b2ba32f714f73bc96c24db5242c2fb8fc04ee389e2b794839d35e1afcf3bca790336e7ad76377a69ec46ff6f8665b34633d404c0f6520673a53d256317d4bfbcca2eaa6f9e4828501be701bfecf15990a1a80140191fc69a49ca99ed8e72e5e41a098aa9109c81c023e0fafb01dd8cb29db226d43bda154bc0d5fe5452907261a01db71b947e5aa190755bf60129b3f3a1b9cdc0580d893ba6ae9c78e19ea46e09c10ce4501466ecb2455e586619da6a9c653487c7b2844b599c964f4e258e192f047ae4f6e849566c99890188f9ffa26646e5a5bea49b4fbe213df93b7717d9c58a50e8121c24668479532733f775b72d23a5d4f78f6b5abc5f772586b119157bd055a89482cca5cb8256be85fa22a3be585cb43cfd00ea8e81f86d3f817909eb7f875f0b789d5aa56eb39c08d9e6948d194f9b175be3379c4937a35ac6887b79f262bed95058b8bb8e71346f520c3ae898d6a22201df623d8f7529da053e698e352db1cf405d62c42779115feae743c1590910885835879c44cc437d2571d18af12a5ea6818598bfb0039867d89442e322ac94152e6b0370dcf246e4dd5f21c92329af2a45f2651bb7e0e61cc7eb1aef0edaa01b9b7fa0bf2aedb7b5d3fe182c116a1abe9e8c8723155bf728a1383d500c864a70b1921f405242c10f01ddfac1e2d8426193aca101287d4137b061a996377a2712422e60ea24c6cd03910cbf3509d122d8c80a70a7454270ae07fb0c687308a06ed97d592a3f85d392c9ea8dc1f6a4eb4277cfe4730daafbb16e570d3554815f12c1f2c5c10e8ecf2a942cdd5dbe98e1c64ef1971523c89689dc4b242405b4542920deb425c0bc53a165d9bef51a8feb9a5dcb4b8718e2b7ebd695feb772be0f6864c4fb97a6d7484d2a63ea79a807804702c222cd9bb352a8306ba4a58fb220b0adf52ad6e5131a6d27945e718d914adc3d7e87eb719cde373e6e01cacb6443cff1e03c30b5a46e5802ac06247ab7eb3d9d5ca380ba26ee9441859bcb53e6a6f5d3ea4c5c216aae879a03d95a08281bc8cb5223959b4944ebc3f57fb48ea23150eacf53509da05fdfdc1f6b6ba31cca3c792fe0a5487d2de7ddfca925699099d45d14630d3d9490963d202a10e357fe88b72fe9f2b3400dcc926c50d3a69b628fddc78e05b107e672c8481d97863d947b3627763f1436c1c69f4b5a010392907031a8aef68d494e48a2f2c7f47aae48d7f5c5a9367c7f414ec409971651cfcce89a4859cd7f86213965e0807d3fd1ca8806be69694a42df2133bff104c9441edb2a3a5f6c053f0e1931ace597084e8c710965b1b9481a826c7a617cf7482fb34cbca0bb17619b76e475a7fc37f77d34842c53a463aac7035940456d602d8a3f437324f8e74cfda3130612108df5b18d287b6caafc5fbad1861bdce6fb079c3e4934cfc30088e12d224be5bfa3dd3ecd774250ea0a3183bc26cbf70e7945433866bb19ef0b92003200e5f628ba90844f3760e437786834bd32cf7a7136972ec8b01ad7703c3574500faa8c2d32abe9fcf63c7fc8b682f23e97d472de5511ae50d7a997119b06e23953d35f8163d2256b597aa24ff338fef75643af5b3afd1b1d22554ff0e8bc50120b3851ca8dba3c1144b87ebc67787a3790917216d5ff9ee48b7acb8077f71a6c734e111caf9caa0a6cccc15083349cc9ea6556d1ea4b5d77ac4fbd8b72769bbbe8463856978733c911180827d4f918874d79735f6ef507e5984827eb4b3af2142ebd2bbe1667add2420696f2949b9fa6d47fabb89f4016623a1da6438f0f7a28f91a7a4e738d52797cc7bbba359c67196b904caf8a07210dbe577e819faf9fdcbed2d21b89313081d5c25e9aa9318094748581c17ba1367a2322ad4159e316bc5735a8d57a5fb2f793023d6c0c85795f13042940bcd5dd39e7c58fcf6656e2d21bb640dd8271dceac9068a3c5a1833c9174f7c84ebf46cf9c86ddeaf8d88c99434776dbf3e92fba3d4523e41a329c91ca478892471291dcbee0b46836d6e5eedffd8af0a9c13941a1bb2f00b94adb9e10cbfa9121f412d1b3b157ab8ddcc83e46bdc2c4a4c9994346d72f8f408f1b8ea80f1dd4ea866531c645972d6a65a1a52ec2efaf19f40bf8fec57b291368d191448edae2f875a8689fd7d6602f7d4a9b9d8816442c1eecc886ba0cf5f8baa92e6a25a977296a3409f351c83d21bd0134c8e138c83a7083ba53912fce22b67b3f91c04403249137074f5f9ba46e7a7d5949b87960fb72d2e5ef590ccaaa113b49cd7341ca4dc169dfb2b62c63ef5edb39caaf8c4cc1efaa2547c37b09a00ea13089d12c5ba23c5a943a6e3f595ce5a4b33ae0d7737157044a45aada45717c145fc63afe8a4566d5aacbeacc27b771879d9c730a5bcd05b2614076dd4fc065fadf6c171b7041c4b636bc4b2c48c1176e70cb46b400de545ad8695de656ef1dbc3d9271a37674767b6b689bc62e1b05804c422d1bc6b09e47797d4e315d94e2092abe35f44d0f13e254a09b7d72a8950fa8d62590a5ecc3165f255bfcde937939d941e2e524f8e1e6578d7292c41d626667b2cdab12ef9c96d51b73d4357cc345760c50273fb79aeeed4ee61fd471c1e7ce1b647c2569af6e6b37b8bec4fe2874da914463f364fce8f697c9bd35cb91c3baeb752828f312f9019c2e71dfbda5c061f2cf7a84fd43f0761abfbb8504aa0c6d2db702d4eeb54477e05057d9fc74fefc0b930cff3d94bea68c608effd3a2e7d9d320c8562040964eeaffc18ce01f0788ddef0716291ad950eda973c3a53e832c8ac014e3976f8352d724eef1ea4453fff5c31f02c02513f75f3748df2f6bb70f85095da76f9430a8b08c8fe060a7a75a83cabf52d9527b066a31a668348ad0d91839369e1e3855840fdfac36bd84331064c0c6c2a9ff94ca008d077abb5ba7809714a789fe92352d2ebd01e34338f11e66c0a295a954de6d2aa2a13e9b2e786448ec0f3123b393dda2ba0f333d43632c4cf65764ab12080e330e18de3238b40252a788900241b56fb094cfb5e064c02de094ec4193371cec53646ba38cbeda89532b97b4f570fe44173a7dde4b7fd9ae3d61ca376625cc93c78c04b65469ce48b47503f862007aae0f892b29111efcb55d14eb06279a1048f50753a0ebcb48c2385a2bd8f5c340111458a323d2467f1d0da71bc72ff1f3bdb1068e4be79f079ee0cd369059c46f5992397cca5b43cb7d3a8393a31e354f0c837cb44751f83543cd8e268c688bc3cb7d377176de3f5a3cf033b97852c47f11df3c186d5e2bf4fe5718d19516f4c7fe27e6d3e69877993a024a9b1c0069fdadc8f4db1cf8c375433b72876333e0de5bab5c004620a45926aa3d391e5506084469202ca7c83cec3951ed9c3437c1613d5a3fecbc477c0205e537dc8181f8a942d24358ed2856cc72fb8ba7cbee3a1c38603799e866c234d6e97a6b4f5fe45e4d2a371eefa0233df512a99723d", 0x1000, 0x2, 0x0, 0x3}]) 00:50:08 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 497.812918] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 497.820283] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 497.827556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.834829] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 00:50:08 executing program 5 (fault-call:0 fault-nth:4): socket(0x26, 0x5, 0x0) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x0, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x2400800c}, 0x6800) 00:50:08 executing program 0 (fault-call:1 fault-nth:0): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010d00000000aa47baaf6a4c41949fb2482f680b50d16303b841e7fd93adf656b158df2bc5a2114230c1337723f34573ea1ba8276df7c6ec5b0692357cf8f479216a5bf8da47aab7b3bd186434dcb3f334c40680dfd3dd67036aa18bdd2129f18e69eae77399b0be6c33d90bebb01892bed6131ac3ac45b4b41ac6765f3719268597e9cefc2507c72cb07b6518bab8ad94f8e01f07151abe07809a8f8080da9753fba1c443150c9aff5c2106b599604436951e3bf19c6c28c680ef8e1381a7c215dc71d51f2d42101b5aaccc7827f20e33a58e1efe0a20a53919b0e3fd4c072145a1b5c44b8f092f0eb447b8a33e00000000000000000088778b31d141e278aea1257dfe8dddd527184f6e186eac41aca78e672f3cc5677f8c852511bd6210be00"/301, @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:08 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x0, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x6800) [ 498.016393] FAULT_INJECTION: forcing a failure. [ 498.016393] name failslab, interval 1, probability 0, space 0, times 0 [ 498.021014] FAULT_INJECTION: forcing a failure. [ 498.021014] name failslab, interval 1, probability 0, space 0, times 0 [ 498.036727] binder: 1649:1655 unknown command 3329 [ 498.050364] binder: 1649:1655 ioctl c0306201 20000800 returned -22 [ 498.075241] CPU: 0 PID: 1651 Comm: syz-executor.0 Not tainted 4.14.230-syzkaller #0 [ 498.083067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 498.092415] Call Trace: [ 498.095019] dump_stack+0x1b2/0x281 [ 498.098646] should_fail.cold+0x10a/0x149 [ 498.102796] should_failslab+0xd6/0x130 [ 498.106772] kmem_cache_alloc_node+0x263/0x410 [ 498.111362] __alloc_skb+0x5c/0x510 [ 498.114991] netlink_sendmsg+0x901/0xb80 [ 498.119052] ? nlmsg_notify+0x170/0x170 [ 498.123047] ? kernel_recvmsg+0x210/0x210 [ 498.127285] ? security_socket_sendmsg+0x83/0xb0 [ 498.132047] ? nlmsg_notify+0x170/0x170 [ 498.136020] sock_sendmsg+0xb5/0x100 [ 498.139731] ___sys_sendmsg+0x6c8/0x800 [ 498.143727] ? get_pid_task+0x91/0x130 [ 498.147613] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 498.152390] ? lock_downgrade+0x740/0x740 [ 498.156540] ? __fget+0x1fe/0x360 [ 498.159991] ? lock_acquire+0x170/0x3f0 [ 498.163997] ? lock_downgrade+0x740/0x740 [ 498.168148] ? __fget+0x225/0x360 [ 498.171623] ? __fdget+0x196/0x1f0 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x5c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x5c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 498.175162] ? sockfd_lookup_light+0xb2/0x160 [ 498.179651] __sys_sendmsg+0xa3/0x120 [ 498.183466] ? SyS_shutdown+0x160/0x160 [ 498.187454] ? wait_for_completion_io+0x10/0x10 [ 498.192153] ? SyS_read+0x210/0x210 [ 498.195796] ? __do_page_fault+0x159/0xad0 [ 498.200056] SyS_sendmsg+0x27/0x40 [ 498.203597] ? __sys_sendmsg+0x120/0x120 [ 498.207661] do_syscall_64+0x1d5/0x640 [ 498.211555] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 498.216742] RIP: 0033:0x466459 [ 498.219939] RSP: 002b:00007f443b4c2188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.227649] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 498.235031] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 498.242298] RBP: 00007f443b4c21d0 R08: 0000000000000000 R09: 0000000000000000 [ 498.249565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.256831] R13: 00007ffeddbd361f R14: 00007f443b4c2300 R15: 0000000000022000 [ 498.264114] CPU: 1 PID: 1650 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 498.271956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 498.281316] Call Trace: [ 498.283910] dump_stack+0x1b2/0x281 [ 498.289542] should_fail.cold+0x10a/0x149 [ 498.293704] should_failslab+0xd6/0x130 [ 498.297689] kmem_cache_alloc+0x28e/0x3c0 [ 498.301875] get_empty_filp+0x86/0x3e0 [ 498.305772] alloc_file+0x23/0x440 [ 498.309328] sock_alloc_file+0x113/0x2e0 [ 498.313423] ? sock_poll+0x220/0x220 [ 498.317151] SyS_socket+0x108/0x1b0 [ 498.320816] ? move_addr_to_kernel+0x60/0x60 [ 498.325235] ? __do_page_fault+0x159/0xad0 [ 498.329476] ? do_syscall_64+0x4c/0x640 [ 498.333565] ? move_addr_to_kernel+0x60/0x60 [ 498.338247] do_syscall_64+0x1d5/0x640 [ 498.342237] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 498.347442] RIP: 0033:0x466459 [ 498.350647] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 498.358553] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 498.366039] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 498.373317] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 498.380958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.388434] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 00:50:08 executing program 5 (fault-call:0 fault-nth:5): socket(0x26, 0x5, 0x0) 00:50:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x5c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:08 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:08 executing program 0 (fault-call:1 fault-nth:1): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x110b, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000040)={@my=0x0, 0x2}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r1, 0x7b0, &(0x7f0000000080)={@host, 0x9}) 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:09 executing program 1 (fault-call:1 fault-nth:0): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 498.492981] FAULT_INJECTION: forcing a failure. [ 498.492981] name failslab, interval 1, probability 0, space 0, times 0 00:50:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:09 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0xe2672d4cff9b4b09) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_si_security={{0x2, 0x7}, {0x104, 0x9, 0xf800, 0x3}}}, 0xa) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 498.540547] FAULT_INJECTION: forcing a failure. [ 498.540547] name failslab, interval 1, probability 0, space 0, times 0 [ 498.575852] FAULT_INJECTION: forcing a failure. [ 498.575852] name failslab, interval 1, probability 0, space 0, times 0 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xb1, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f830549f479de5d6d685f96320fa2996ff9cc23d6a107a8bda1866d918faefde082eb744ac6d847f9961d9410a4f83d96a725044abd65d65839706cbe82441b65c3287aa0274f819e32f740769bb61f783936faddf81863d2b6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 498.620315] CPU: 0 PID: 1702 Comm: syz-executor.1 Not tainted 4.14.230-syzkaller #0 [ 498.628146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 498.637622] Call Trace: [ 498.640393] dump_stack+0x1b2/0x281 [ 498.644028] should_fail.cold+0x10a/0x149 [ 498.648176] should_failslab+0xd6/0x130 [ 498.652249] kmem_cache_alloc_node+0x263/0x410 [ 498.656932] __alloc_skb+0x5c/0x510 [ 498.660572] netlink_sendmsg+0x901/0xb80 [ 498.664637] ? nlmsg_notify+0x170/0x170 [ 498.668646] ? kernel_recvmsg+0x210/0x210 [ 498.672797] ? security_socket_sendmsg+0x83/0xb0 [ 498.677591] ? nlmsg_notify+0x170/0x170 [ 498.681572] sock_sendmsg+0xb5/0x100 [ 498.685303] ___sys_sendmsg+0x6c8/0x800 [ 498.689301] ? get_pid_task+0x91/0x130 [ 498.693203] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 498.697958] ? lock_downgrade+0x740/0x740 [ 498.702120] ? __fget+0x1fe/0x360 [ 498.705592] ? lock_acquire+0x170/0x3f0 [ 498.709578] ? lock_downgrade+0x740/0x740 [ 498.713772] ? __fget+0x225/0x360 [ 498.717258] ? __fdget+0x196/0x1f0 [ 498.720803] ? sockfd_lookup_light+0xb2/0x160 [ 498.725361] __sys_sendmsg+0xa3/0x120 [ 498.729367] ? SyS_shutdown+0x160/0x160 [ 498.733478] ? wait_for_completion_io+0x10/0x10 [ 498.738319] ? SyS_read+0x210/0x210 [ 498.742234] ? __do_page_fault+0x159/0xad0 [ 498.746668] SyS_sendmsg+0x27/0x40 [ 498.750222] ? __sys_sendmsg+0x120/0x120 [ 498.754287] do_syscall_64+0x1d5/0x640 [ 498.758269] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 498.763463] RIP: 0033:0x466459 [ 498.766840] RSP: 002b:00007f565add8188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.774945] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 498.782303] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 498.789935] RBP: 00007f565add81d0 R08: 0000000000000000 R09: 0000000000000000 [ 498.797228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.804537] R13: 00007ffc08bcdddf R14: 00007f565add8300 R15: 0000000000022000 [ 498.815934] CPU: 1 PID: 1700 Comm: syz-executor.0 Not tainted 4.14.230-syzkaller #0 [ 498.823776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 498.833166] Call Trace: [ 498.835791] dump_stack+0x1b2/0x281 [ 498.839433] should_fail.cold+0x10a/0x149 [ 498.843692] should_failslab+0xd6/0x130 [ 498.847696] kmem_cache_alloc_node_trace+0x25a/0x400 [ 498.852900] __kmalloc_node_track_caller+0x38/0x70 [ 498.857924] __alloc_skb+0x96/0x510 [ 498.861563] netlink_sendmsg+0x901/0xb80 [ 498.865983] ? nlmsg_notify+0x170/0x170 [ 498.869969] ? kernel_recvmsg+0x210/0x210 [ 498.874130] ? security_socket_sendmsg+0x83/0xb0 [ 498.878897] ? nlmsg_notify+0x170/0x170 [ 498.882878] sock_sendmsg+0xb5/0x100 [ 498.886785] ___sys_sendmsg+0x6c8/0x800 [ 498.890775] ? get_pid_task+0x91/0x130 [ 498.894683] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 498.899448] ? lock_downgrade+0x740/0x740 [ 498.903613] ? __fget+0x1fe/0x360 [ 498.907127] ? lock_acquire+0x170/0x3f0 [ 498.911190] ? lock_downgrade+0x740/0x740 [ 498.915370] ? __fget+0x225/0x360 [ 498.918834] ? __fdget+0x196/0x1f0 [ 498.922402] ? sockfd_lookup_light+0xb2/0x160 [ 498.926904] __sys_sendmsg+0xa3/0x120 [ 498.930707] ? SyS_shutdown+0x160/0x160 [ 498.934769] ? wait_for_completion_io+0x10/0x10 [ 498.939480] ? SyS_read+0x210/0x210 [ 498.943451] ? __do_page_fault+0x159/0xad0 [ 498.947804] SyS_sendmsg+0x27/0x40 [ 498.951331] ? __sys_sendmsg+0x120/0x120 [ 498.955376] do_syscall_64+0x1d5/0x640 [ 498.959359] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 498.964575] RIP: 0033:0x466459 [ 498.967782] RSP: 002b:00007f443b4c2188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 498.975481] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 498.983081] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 498.991319] RBP: 00007f443b4c21d0 R08: 0000000000000000 R09: 0000000000000000 [ 498.998773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.006034] R13: 00007ffeddbd361f R14: 00007f443b4c2300 R15: 0000000000022000 [ 499.018977] CPU: 1 PID: 1691 Comm: syz-executor.5 Not tainted 4.14.230-syzkaller #0 [ 499.026804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 499.036258] Call Trace: [ 499.038873] dump_stack+0x1b2/0x281 [ 499.042531] should_fail.cold+0x10a/0x149 [ 499.046712] should_failslab+0xd6/0x130 [ 499.050700] kmem_cache_alloc_trace+0x29a/0x3d0 [ 499.055388] apparmor_file_alloc_security+0x129/0x800 [ 499.060597] security_file_alloc+0x66/0xa0 [ 499.065021] ? selinux_is_enabled+0x5/0x50 [ 499.069266] get_empty_filp+0x15c/0x3e0 [ 499.073258] alloc_file+0x23/0x440 [ 499.076825] sock_alloc_file+0x113/0x2e0 [ 499.080906] ? sock_poll+0x220/0x220 [ 499.085044] SyS_socket+0x108/0x1b0 [ 499.088677] ? move_addr_to_kernel+0x60/0x60 [ 499.093093] ? __do_page_fault+0x159/0xad0 [ 499.097425] ? do_syscall_64+0x4c/0x640 [ 499.101437] ? move_addr_to_kernel+0x60/0x60 [ 499.105861] do_syscall_64+0x1d5/0x640 [ 499.109800] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 499.115098] RIP: 0033:0x466459 00:50:09 executing program 5 (fault-call:0 fault-nth:6): socket(0x26, 0x5, 0x0) 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:09 executing program 1 (fault-call:1 fault-nth:1): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:09 executing program 0 (fault-call:1 fault-nth:2): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 499.118299] RSP: 002b:00007f5de8c10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 499.126112] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 499.133389] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 499.140870] RBP: 00007f5de8c101d0 R08: 0000000000000000 R09: 0000000000000000 [ 499.148149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.155471] R13: 00007ffe4897ce8f R14: 00007f5de8c10300 R15: 0000000000022000 00:50:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="78598903", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 499.212243] FAULT_INJECTION: forcing a failure. [ 499.212243] name failslab, interval 1, probability 0, space 0, times 0 [ 499.228439] FAULT_INJECTION: forcing a failure. [ 499.228439] name failslab, interval 1, probability 0, space 0, times 0 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:09 executing program 5: socket(0x26, 0x4, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendto$l2tp6(r0, &(0x7f0000000000)="20c13fd304293b168d0fd3f656da6bfa011385fcabbbf7ab6ddbc141df029090c05db125f0333b288e6f7f9aa14c2232f3d9f2cf20df37120e0c97feca75a57796820ecb53f4c91616ee5893676a37a59eebbbc10a3eae76646da9b9b442cd5d324bcdbed83d3314984b5b090ce149c32e8b6b2a18dcc485d2d5cbf981ab088d36961d781b505a807e5d066024d72ac3aa56c5b6c475b4e239961f9343eb339f8c0fe59836a96a088534486958e6d669ce9d4aa090e3c6e99820c0ee374f3e8fc40a37f4e4c1f3a0aad96f0779341bc5bfe400d76ad1f63b454aaf0abc504e37b8ea7dbed1582b229e7c1e222fc32d5924c27f2a13876d56a3f1dbd65b580cecbd820b3d720ff223f417c118f5a50d28d45aaab6537c8e545d5f55e452d2dfb291c4e868b98e83476f27eaa6c72fc6c92c1c12f1a180111d598ad27c839c5a8017e62772643a9a695a9420016092eccca495520ae2659a660311c8160604f7071b480cf2b5879618b38e74bd1cbadf2814d88130248c69899549912a15105119e18f8c9a248d145698e3cd7171ecbb9bd8086c5dc97fd6a62203746463a93527f96eda19015846843adb177fa180100e85734a9705d43fd914460fd66855171edd88628b0c1e03d187ff6bd8aafdb65fa3e37cddb3a5182fb629295a68e01f9cc9a302ae8241274f3a68301e067e12df7dff97426ab6ec7800d776c0e92ccaaef74822b2721ccad212813ddaacd40a931e75a9518faa6b663bfb5a16b9dce43c228c94530716eee5e4ecbac0e234f416be04ad12b71ed9724c13d4974019bf19619aa1db3a8ea3b7da8bfe733d3d1c1cb570f6f7ad7b65f91cfcbd121070150d8de46957331d7c2875d6081ef171fff81aa145b8aeac3204f374cf53c0ac4ba085c6fd71635fb5f8f914e33377374344f2d45fac7a5c9f22622fe298e71663511ee6d3bf519295ec957b96dcce9b4fd412b42fe557afcfabf1e494ccc16fde4259533122d539e8d72470501bb8b11845a949b37a68d0a4d5a752f8ed83b28aecf5c15b982e0e26968cbd894e3192a3caf28f59c724362360e55afc73093a1d9fef6397ceebd5bf72ad4941cfa7bf96994b42e9b295380663f3d26f752aea64cf9d556a8d12834b153faa03d44ad5a1a4212263fe24fe52343093f67710316cac013bc37e6be34077ef6b36035b6d72e4dce1c4b463a8e446a8b6615acc492ad99fc0ad69069f9f5a10dd15b2b71d99e967379abdd3c272d988cabb5bf1d02391bc0309ff4631f3a12bdd1b9783877677bc98b79ef2757d0f83cb9166cfd2b75b2b1a46c3e715c5fab78231432bd4e307e771f1b625ecf899fd5d929de0c5a26b1c1fa6e46deec7823a65a2b086a197f21bda8356af3fc37e21b69b652c09caf9d435e4d7077c263cb975c46ad93e4e63f4621e251804b549990122edf766b99d38cda95a1f6aba5e3bfdda9df41a48a31239fa9ca22baed4b9bc20a924bedd7322adcef5d1980a8d625faa1972e04908b21a331e332ab3013f68046bb56a716b4724d1e6404b4d8d9c60b1fdf52310e9ab987d2e34585b414f652c1f30251b692dff9336d12e7bf6c8e6910d2ed6dc494f48123d137205db556bf4cf8f9c5abb76fc8aa1d3c1a756c6438a9d90e6e7e1966916c11d20a440b500755bb043a1d7115e73f22d952c589a813fcea4ecee6dcc2211f33f4c0ee2f7759541b340e271ec51c824d4a2146e70067c830fdfbdbd0c62d854909ff2bbf709b9625dd1421cb8184ce7b66537bc9304ea129d704ebdcd34e15e34a79f886c9b0eab813c906c49c82270b7aef04ac430ddf088473acc5167b2010aef16ac42d0c99c0dd25da1f7435cd0d68b03d34409d7d85b3c0487bdd52836c6756eb2df5b4c2eccfccd3fc90eb2622d59c040bfc9b736fd583463faa0ebf51c63ac32e798d4bb3813c2ff4c43666903f4cb088a9034d3dfc6be67ac16b2286fd7916ec8385bbbf893a67a9fbad624c15e884585583f3ea430407bdedafbaf9f26f5d7e9bdba9bcefc92e81d59e781a45d9793aceb03d0c922287db8d512d79a11dcd50ffcdc0b17cec58d2e7a8b1893dfa61fc00d274d5f4c2a4aa9860e9be6467c9d382c626e5433707ac016611f8584411e9912a13ce9d348ffb570b73f5d3374bb88246bb9e455cc79d714f7c873faa2570b9dde3980644478de3a7f485cb048eea856cdbeb62bb257ecf84c1fefd2715011e5804f3da4c5787c7a9a0b0f99092489e06f03e12636d9bca1ad30b3edb22827a3c5266d1a60c2a1e833cb66e2a25941e1b7af9cb7f56c30a4fa0b60d7c2e830c136c8d680b7d43947df0894b1c884c4aa3a5992bd3ae0157a0c84c17a64f4ce7351cd9c429b5994d2d8094e7560c8ae89c3f4a9169c889fb0c03cfaedb392389bbab0bedfe63e819b881cdaff9ee6f8d80b34f5e48c557d4c0ce4051608a4bba00a0ae2f41715d640b89f8a99bbfc8bb4dcb6e9b907a1463428e25c8d9c42e0c3c9f2543b1507e3d7d77e3f29c5f71e0e6e51808aab595d2963e4d48a8c0f3dc8f310a5d3c2989ce808371582dc99cca0df927a62d630c9a65f53ea701eb8f525dadc9d74e8bfb9c44cddbfe28d695aca48de2080c17d91c962507147569d2974f20c7330e3040d9effe1d852751ec4364f4763fd87a98bc458eb79572d678a1fd23ff6d78447d4e3a504fa778405b8f95e439b3322ae189517b69397840c8d9c8396969644f7b63eb0d2fa302c444f1ba21eca6a816568473405630fb5209265bfc14ddd7a97288aa5dd9fa7209a2a0c57f2c481de3381e7058b10a50729772dabeafab44c396b2f747cbb9784d0dc165c039e886eb6cfac6479fd13de4054caf381e72a34e67c42e3c808526586ff9a5e98efe7233260cb597bdcd7bd72e222de3774a808642f7000fef6b05f9b0c19d30ade6b60f11227009c17bca29da7f4ed3edea5ac7fb7d842459a660e57e557932e0f0eeea9d51ae3d2620100267bfb0732b1687f76ee4908bf84e602dfc2952dd7613faaba19056773db7ba981bca370d0aca77665e40a0cb49cc145d6bd57dd886aa92f703f210394d66cc795ea39489ce860ac9e29b2a1274f9dbc0eecfca064bccc700098636f63bfac5854e815410f382a2c234d9c139be80669f70149145c78434aab3b229506b56290505c61d52d737b56187a61f0993dd829ccd4b1863ea8349561b377b336f6208b53442ee3f84539e20389a7b6b3ef5edc8cca18bf9c9884b2d4963c7edeb5bbe49d22ba4b1d78d525a5cee9e8337b7abdb64aee56d41c01fe85b03c540614fe551a3b1724b5fff6813732cac78b36d2b82d5183abd7f8e647f3b3dfba9fd337a9ee1aaf49e7692416d280ad9922fc28f81f34ea4d88bd5cc2dc9f522edc4910f53fa7b5a5d3aa24d846a3223d7cf6b71476219b35ea3282d83f0c445ef725bb7a3bfb97347bfd5368e8348cffc27764d521603217691ca9de3e678b03126ea63ae582df091395a0d17d9f984448b635ca1d8a385da40cc0d4b7e8a6878cf2166df316d4890b34fc8a1f8ee027907d39674849baa5706195296ead92178431c2e5b76857481cd4ec2c4ca0644aad662364db6ee64dad62c79f4a4bbead1ac3a47e6ef289d90d7a121bda5e3c1a1e85d5550fa979ad0f9e5708a78cd374f8d883a435e3f6d95089683a69b525b90f9d99cf3231971ac23e6ead50e39644c49f15130df8450592012ccdc33697a8c2f139bda889794738ce8d57769ed92875f9b99ada411322c130c5c1f24c9f50248da9ac02597bc0843f0b15ea6ea3be55399855bb6a0fda1490df0190184f8af85d33125f928ec6448aecfd3e03185e61c4788a511d6764c9d29b1fcc886f4b87f97085fc7bb0b76a533f5bea83060c20c360b687c0fa08094c8326b9c2f45a244d38ec2b4bf45df4b5636dca409275fefc44cf518192578dd00e3452214fb96722edd1d2b408bc04e944edc4af0fc7095abf774cf1b0f586d88feaece75e5996202c9b80b807e65250c4bd56fdf442d0811525b2707ea7208af46f82087d6db2d1024f78e76a3481851fcaeee1695caf2f28ed136114905ffc217237f89a4a33227ba2dd26b8e29d17b4006300b5755d7ed5d6df63d496bf0ef4322660860da4f0b76fe4c998e83ec32f4b712fa0a56523e2c3e7197d30bf7bc04347b5352ff527f2c6a63f15e6d2fbd7d2b56fd2ee5d2f06212d0edc763069a0be7deb9d3b5b89bc97bf3c6af021269577be1eb64c9498efb02db22084628e2c85fe0dc08302d7d7d6d822f6e53a8b25c333fd20eb80dfc873e7c27f705a471d4ca2563f55ec63d2662f8499fb7336ae4d9bde2462270e5cd354b2bd1c51a5bbc28c5df4577e3f24dd01844e550246ac46d2926eeb4cac8d1fb25441121a4fdbe34c372585bf09e85e6f6d16ef09b6b4631d1520029f74b7b9b8d02f87096db16b6a522c16c2d294035bfaaec2f3269b6cbdf6a6b40dd7a1ea9466ffc55cb0328f5fa01ad3fb33d4e4805810e43417169bbffad47fe62795ec53dba2e972a7fe980197e8b042fef215f47f34406f2d281126def9face0a3a00beec45a8e8ffc89a094c1795df97edafaba6561545bec0175d57141334142397d9d35e2c21e7e787c35e6fdbd93d44f10aa872a4c46da416f3a2cc15bc9b2c9340e8fc0a751a8db5db82871949b4f127057689c4fa46455c50bab5a11964ee248397e862ce0e567bd50b29ac5b9893594e046927709001a645926a141adff5ab9dfb8d57a2856d6509c7ed92398499b86ba7b236c77ebca624deac248104d939e002c4a3c017ea06856cce87248d45896ec18c34714e5b761b791a36708249e1f50cf0359a821188531c4f3cd43a7322a29b4d5216216d898c54e2eb5411598655ff00316e298699a43d678750e8770ed4bd10246e9171ec7a6af397e06beb06760910933d91a0600ac1292d1d49ac182677cee3bf9d002c9abec17514b46ecc127f3c162339f0e777e365b904ec84086071bc9def503359b66304d4febc012b0b88d9322085b0ebcb29d1c13daf62d3d356cfce054ded4225ae70e54950d61e36e2ecb92d9b05c348edf5102bd5fcad60ee870a886386159a8b58be444a49c10b6f89cbb69c1600b306156decf2b5cece94e0c8e2c748a06329b36e7101f7817beb170c7ee5ca5ffc64349987546b08be79fe38da6e6486e4aacef6968161993b2bdeddd92c10e7d40fd19875955f4b664361f37b47c9e41bc2089ce961592676e4ae67a1f204b9c0b2d9a2f53d6fc8f46bef09e8238da3aec43f07fb07a22fde0345199220fddc3ea780b66a746f470125cc03bad8fd5d56b0763604be34417f263d2b93f12c5fccb592bca8e899ef252363712d3ad5b0e14c624be099d9d8e4035a2f44ede934f09e1447d3f1d1f6ab3fc9495f4997d7cac5239fcc78af20c018feb8cdcee7f68f3d444f7c36ff81c48cf73277eeb2631b5d012a254f6cd581be1aa8f26feb4973096732fc883b546a7e144d395ab30aa27f1cd2081986f6b6cb9e56e26f7d2422ea43fd226328fdf704af1253c3421b19b1064dfe7578efa0a7dccc4731ea39920e56298f29dbaf9ea5534e6edad2567a3e24eb776a41fd46f39a0378e9add2ac08544120821ac5cd291b76e65e9829986dd65ba7ce7750cbb90faf20d32a120f7d4c6394419110f16a37b667ed96185658ddf139b4566453f15a6785cc60507aa6ed4a7178e0d7dccc78544c007bb9b4afa0e7ce016feeee2555d29ab3d379ee48d3b33357a7ad96f427c9c0b6d9649e", 0x1000, 0x20040001, &(0x7f0000001000)={0xa, 0x0, 0x401, @local, 0x2, 0x1}, 0x20) [ 499.269623] CPU: 1 PID: 1735 Comm: syz-executor.1 Not tainted 4.14.230-syzkaller #0 [ 499.277497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 499.287221] Call Trace: [ 499.289936] dump_stack+0x1b2/0x281 [ 499.293592] should_fail.cold+0x10a/0x149 [ 499.297758] should_failslab+0xd6/0x130 [ 499.301751] kmem_cache_alloc_node_trace+0x25a/0x400 [ 499.306953] __kmalloc_node_track_caller+0x38/0x70 [ 499.311894] __alloc_skb+0x96/0x510 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 499.315532] netlink_sendmsg+0x901/0xb80 [ 499.320419] ? nlmsg_notify+0x170/0x170 [ 499.324408] ? kernel_recvmsg+0x210/0x210 [ 499.328568] ? security_socket_sendmsg+0x83/0xb0 [ 499.333333] ? nlmsg_notify+0x170/0x170 [ 499.337316] sock_sendmsg+0xb5/0x100 [ 499.341036] ___sys_sendmsg+0x6c8/0x800 [ 499.345032] ? get_pid_task+0x91/0x130 [ 499.348948] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 499.353729] ? lock_downgrade+0x740/0x740 [ 499.357924] ? __fget+0x1fe/0x360 [ 499.361415] ? lock_acquire+0x170/0x3f0 [ 499.365406] ? lock_downgrade+0x740/0x740 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:09 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x0, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 499.369564] ? __fget+0x225/0x360 [ 499.373137] ? __fdget+0x196/0x1f0 [ 499.376694] ? sockfd_lookup_light+0xb2/0x160 [ 499.381317] __sys_sendmsg+0xa3/0x120 [ 499.385124] ? SyS_shutdown+0x160/0x160 [ 499.389131] ? wait_for_completion_io+0x10/0x10 [ 499.393811] ? SyS_read+0x210/0x210 [ 499.397454] ? __do_page_fault+0x159/0xad0 [ 499.401705] SyS_sendmsg+0x27/0x40 [ 499.405382] ? __sys_sendmsg+0x120/0x120 [ 499.409469] do_syscall_64+0x1d5/0x640 [ 499.413356] entry_SYSCALL_64_after_hwframe+0x46/0xbb 00:50:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 499.418577] RIP: 0033:0x466459 [ 499.421788] RSP: 002b:00007f565add8188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 499.429518] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 499.436813] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 499.444168] RBP: 00007f565add81d0 R08: 0000000000000000 R09: 0000000000000000 [ 499.451441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.458787] R13: 00007ffc08bcdddf R14: 00007f565add8300 R15: 0000000000022000 [ 499.469103] CPU: 1 PID: 1736 Comm: syz-executor.0 Not tainted 4.14.230-syzkaller #0 [ 499.476946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 499.487616] Call Trace: [ 499.490290] dump_stack+0x1b2/0x281 [ 499.494042] should_fail.cold+0x10a/0x149 [ 499.498197] should_failslab+0xd6/0x130 [ 499.502195] kmem_cache_alloc+0x40/0x3c0 [ 499.506263] skb_clone+0x126/0x9a0 [ 499.509837] netlink_deliver_tap+0x655/0x7d0 [ 499.514271] netlink_unicast+0x485/0x610 [ 499.518422] ? netlink_sendskb+0xd0/0xd0 [ 499.522481] ? __check_object_size+0x1b/0x230 [ 499.527092] netlink_sendmsg+0x62e/0xb80 [ 499.533966] ? nlmsg_notify+0x170/0x170 [ 499.538048] ? kernel_recvmsg+0x210/0x210 [ 499.542200] ? security_socket_sendmsg+0x83/0xb0 [ 499.546959] ? nlmsg_notify+0x170/0x170 [ 499.550931] sock_sendmsg+0xb5/0x100 [ 499.554741] ___sys_sendmsg+0x6c8/0x800 [ 499.558730] ? get_pid_task+0x91/0x130 [ 499.562610] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 499.567373] ? lock_downgrade+0x740/0x740 [ 499.571514] ? __fget+0x1fe/0x360 [ 499.574947] ? lock_acquire+0x170/0x3f0 [ 499.578902] ? lock_downgrade+0x740/0x740 [ 499.583032] ? __fget+0x225/0x360 [ 499.586480] ? __fdget+0x196/0x1f0 [ 499.590002] ? sockfd_lookup_light+0xb2/0x160 [ 499.594477] __sys_sendmsg+0xa3/0x120 [ 499.598273] ? SyS_shutdown+0x160/0x160 [ 499.602230] ? wait_for_completion_io+0x10/0x10 [ 499.606882] ? SyS_read+0x210/0x210 [ 499.610503] ? __do_page_fault+0x159/0xad0 [ 499.614718] SyS_sendmsg+0x27/0x40 [ 499.618252] ? __sys_sendmsg+0x120/0x120 [ 499.622293] do_syscall_64+0x1d5/0x640 [ 499.626187] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 499.631371] RIP: 0033:0x466459 [ 499.634543] RSP: 002b:00007f443b4c2188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 499.642242] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 499.649503] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 499.656753] RBP: 00007f443b4c21d0 R08: 0000000000000000 R09: 0000000000000000 [ 499.664020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.671277] R13: 00007ffeddbd361f R14: 00007f443b4c2300 R15: 0000000000022000 00:50:10 executing program 1 (fault-call:1 fault-nth:2): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x0, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:10 executing program 0 (fault-call:1 fault-nth:3): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 5: r0 = socket(0x26, 0x5, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r1, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x81}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xe5c1}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x400000c0}, 0x24000004) 00:50:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(0xffffffffffffffff, 0x7aa, &(0x7f0000000140)={{@my=0x0, 0x7fffffff}, 0x27, 0x8000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)={0x3}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x420, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0xc000) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x0, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 499.756043] FAULT_INJECTION: forcing a failure. [ 499.756043] name failslab, interval 1, probability 0, space 0, times 0 [ 499.811279] CPU: 0 PID: 1771 Comm: syz-executor.1 Not tainted 4.14.230-syzkaller #0 [ 499.819113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 499.828498] Call Trace: [ 499.831096] dump_stack+0x1b2/0x281 [ 499.834730] should_fail.cold+0x10a/0x149 [ 499.838885] should_failslab+0xd6/0x130 [ 499.842862] kmem_cache_alloc+0x40/0x3c0 [ 499.847186] skb_clone+0x126/0x9a0 [ 499.850736] netlink_deliver_tap+0x655/0x7d0 [ 499.855159] netlink_unicast+0x485/0x610 [ 499.859235] ? netlink_sendskb+0xd0/0xd0 [ 499.863312] ? __check_object_size+0x1b/0x230 [ 499.867817] netlink_sendmsg+0x62e/0xb80 [ 499.871919] ? nlmsg_notify+0x170/0x170 [ 499.875904] ? kernel_recvmsg+0x210/0x210 [ 499.880066] ? security_socket_sendmsg+0x83/0xb0 [ 499.884830] ? nlmsg_notify+0x170/0x170 [ 499.888809] sock_sendmsg+0xb5/0x100 [ 499.892529] ___sys_sendmsg+0x6c8/0x800 [ 499.896534] ? get_pid_task+0x91/0x130 [ 499.900427] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 499.905205] ? lock_downgrade+0x740/0x740 [ 499.909361] ? __fget+0x1fe/0x360 [ 499.912854] ? lock_acquire+0x170/0x3f0 [ 499.916829] ? lock_downgrade+0x740/0x740 [ 499.920960] ? __fget+0x225/0x360 [ 499.924402] ? __fdget+0x196/0x1f0 [ 499.928030] ? sockfd_lookup_light+0xb2/0x160 [ 499.932519] __sys_sendmsg+0xa3/0x120 [ 499.936314] ? SyS_shutdown+0x160/0x160 [ 499.940276] ? wait_for_completion_io+0x10/0x10 [ 499.944932] ? SyS_read+0x210/0x210 [ 499.948555] ? __do_page_fault+0x159/0xad0 [ 499.952807] SyS_sendmsg+0x27/0x40 [ 499.956343] ? __sys_sendmsg+0x120/0x120 [ 499.960396] do_syscall_64+0x1d5/0x640 [ 499.964269] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 499.969438] RIP: 0033:0x466459 [ 499.972607] RSP: 002b:00007f565add8188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 499.980306] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 499.987564] RDX: 0000000000000000 RSI: 0000000020000640 RDI: 0000000000000003 [ 499.994818] RBP: 00007f565add81d0 R08: 0000000000000000 R09: 0000000000000000 [ 500.002071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 00:50:10 executing program 5: socket(0x28, 0x800, 0xfffff004) 00:50:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x40000002) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000040)=[@exit_looper, @free_buffer={0x40086303, r1}, @increfs_done={0x40106308, 0x1}], 0x0, 0x0, 0x0}) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x59, 0x0, &(0x7f00000001c0)="00ee58df376dd0e155149a27bd4b54278d704eb7ebf61356c4f5eadebf23f89f26b9181c6a6900818a037d28e4cab0f09b1fcdd01b06955f2ab2cb414726f639b331f3d8f265cc27ef37a2030f812e8b93f1c9d4d628737f83"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x0, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) io_setup(0x6, &(0x7f00000002c0)=0x0) io_submit(r2, 0x1, &(0x7f00000004c0)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) io_cancel(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x2, 0xffffffffffffffff, &(0x7f0000000080)="c3cf55f35c872b0cc16b5bd601d6165cf90e54e325d342deaf672f85fdd2884af1630c60388360cf26d20dafdfba0cedc20515096ad4aa6bff07b9101fcea718d3715ef063cf1c4935796a50a0b2bc52d75c98834b286693e48d58aed2c42911a955a160998dfe1ea0b186b4ab2fc9e3725cc441c1f3e0d74542dff315f2e1c8645c4a37a9115930", 0x88, 0x5, 0x0, 0x3, r1}, &(0x7f0000000140)) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x2404c809}, 0x8880) [ 500.009323] R13: 00007ffc08bcdddf R14: 00007f565add8300 R15: 0000000000022000 00:50:10 executing program 1 (fault-call:1 fault-nth:3): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:10 executing program 5: socket(0x1, 0x5, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000080)={0x0, 0x101, 0x80000001, &(0x7f0000000040)=0x200}) 00:50:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="016308404648b23212f99dd7327282b1e5ba536d54b38f5e2a827e2ebeccfa074f9fe9f41cd7285ad928cf8a4e7857f5f1fff4dcc1a9a06ecc00631b09e571d2a1780fb512c505d2711b37c303f9384abd68975f4ec6578af114d66fd6fd60c92ed2418a953359ad179a747bbad3f5ded7ba0d06cc9f27b2258979f4df3b51c700b4ce79a7a66b441524aa0886bfd9e44b1ee009b04afdfe1a7e9c8e180a48f6041238a1c787a18d5aad4c58b8cfc2ed2d8cdfb7d5a3baa70020e29639eebaaf1daa51a12b4df2722698ed171aaf94f8216885eb389e132462a250834a0b7800d3c20f12e67381250964b208247bd615bcf56adbca7aca859b91fad82f4394d9b9851af1468fe918e9234aef9ff31e189efd0bbd14cc4f7c538a6553ac9d6e8d8b72b2524eba2c266739390c73bebc17ae4a4ef8e6e8c1", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x0, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) getsockname$l2tp(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x2401c024}, 0x24048894) 00:50:10 executing program 5: socket(0x26, 0x5, 0x0) socket(0x23, 0x80000, 0x3) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x0, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 500.204236] binder: 1810:1818 unknown command 1074291457 [ 500.236568] binder: 1810:1818 ioctl c0306201 20000800 returned -22 00:50:10 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) write$vhost_msg(r0, &(0x7f0000000100)={0x1, {&(0x7f0000000180)=""/172, 0xac, &(0x7f00000000c0)=""/4, 0x1, 0x1}}, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:10 executing program 0: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) write$vhost_msg_v2(r0, &(0x7f0000000100)={0x2, 0x0, {&(0x7f0000000680)=""/4096, 0x1000, &(0x7f0000000040)=""/140, 0x3, 0x1}}, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:10 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000801}, 0x4) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000002140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002100)={&(0x7f00000020c0)={0x40, r1, 0x889, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_PID={0x8, 0x1c, r5}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x40040) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x14, r1, 0x10, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x40101) socket(0x3, 0x3, 0x0) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="a4010000160010002dbd7000fbdbdf257f000001000000000000000000000000fe80000000000000000000000000000c4e2000004e2100050200008089000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000001000100013c0000007f0000010000000000000000000000000101000000000000050000000000000001000000000000000800000000000000000400000000000002000000000000000800000000000000010000000000000000fcffffffffffff0500000000000000ffffff7f0000000000f0ffffffffffff0600000034330000ff0300002dbd7000073500000200001f84000000000000000400000007000000ac000700ac141433000000000000000000000000e00000010000000000000000000000004e2200004e2000050a00000088000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYBLOB="ffffffff00000000ebffffffffffffffcb0500000000000040a800000000000900ff009c9b180000000000f0fffffe7f0000000300910e00000000000005000000000000000600000000000000ffff0000000000001f0000000000e71434fc36fa35b400"/112], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x2e) 00:50:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x802) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vmci\x00', 0x2, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x181841, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x10000) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000001c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x8040) 00:50:10 executing program 5: openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) socket(0x26, 0x5, 0x0) 00:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 500.492750] binder: 1860:1868 unknown command 0 00:50:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = gettid() getpgid(r2) r3 = getpid() r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r3}, {0x0}, 0x37bf, 0x9}) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000240)={0x401, 0x7, {r3}, {r5}, 0x6, 0x7}) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0xfa}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xccd8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x45}, 0x4000) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f00000000c0)={0x7ff, 0x1, {r2}, {r6}, 0x7f, 0xffffffffffff8edf}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000000)={0x9, {0x401, 0x0, 0x800, 0x1f, 0x5, 0xd40}}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 500.531366] binder: 1860:1868 ioctl c0306201 20000800 returned -22 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:11 executing program 5: socket(0x26, 0x5, 0x1000) 00:50:11 executing program 1: setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x1, 0x4) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:11 executing program 0: ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f0000000200)={0x7, 0x5, {0x54, 0x1, 0x7f, {0xfffa}, {0x8000, 0x8}, @rumble}, {0x57, 0xd15c, 0x9, {0xe14, 0x7}, {0x401, 0x1000}, @cond=[{0x9, 0x8, 0x7, 0xd31d, 0x7f6, 0x80}, {0xe27c, 0x2, 0x9, 0x5, 0x800, 0x1f}]}}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-monitor\x00', 0x82000, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x40805) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000040)={0x6, {0x6, 0x3, 0xac, 0x7, 0x80, 0xfb}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 5: r0 = socket(0x26, 0x5, 0x0) pipe2(&(0x7f0000000000), 0x0) r1 = socket(0xf, 0x80000, 0x0) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x1, 0x0, 0x1, {0xa, 0x4e20, 0x5, @private2={0xfc, 0x2, [], 0x1}, 0x3}}}, 0x32) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x11041001}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)=@delpolicy={0x1b4, 0x14, 0x400, 0x70bd2a, 0x25dfdbfd, {{@in=@dev={0xac, 0x14, 0x14, 0x1c}, @in=@dev={0xac, 0x14, 0x14, 0x18}, 0x4e21, 0x0, 0x4e23, 0x2, 0xa, 0x0, 0x90, 0x0, 0x0, 0xee01}, 0x6e6bb4}, [@etimer_thresh={0x8, 0xc, 0x4}, @srcaddr={0x14, 0xd, @in6=@empty}, @extra_flags={0x8, 0x18, 0x7}, @algo_comp={0x13e, 0x3, {{'lzs\x00'}, 0x7b0, "569ebd5f3af72b69a65ad05d28bc43f37c952c93f04737b6cebbf961903a2a850dcc1c275f5390d342e748d8488af4837a0ad5e57b957a868c76d064a5bb3a84fab672a787b1641e5aade9e0970750d93535843749e316514c149801e2b31c1d44ea568987edcc4d7869c6b053d76a7d34b0b991f3e67376c3a177bc26f6d6dfa4c53ab59a263cddf4aa1dae5c6a9d68455dfee603cb3db7a9a64a699efa98ee0e04b7b559769dbb97655686940146847f1253413474e947240b41b632bc28956553ce4605fb8824188b46b851157553447ffb152de17a09019701a694e515e0b27e05056873dfae508cf4ccf97e249f25758f51f8bc"}}]}, 0x1b4}}, 0x40010) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r1, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x80}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x240488c0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r1, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40c4}, 0x4008000) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, 0x0}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="bab110f4", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x80}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x44040) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) 00:50:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0xffffffff) socket(0x26, 0x5, 0x0) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, 0x0}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000000)={@host, 0x1}) 00:50:11 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x4004051) socket(0x26, 0x1, 0xa7) [ 500.776694] binder: 1912:1916 unknown command -200232518 [ 500.794096] binder: 1909:1914 ioctl c0306201 0 returned -14 [ 500.795535] binder: 1912:1916 ioctl c0306201 20000800 returned -22 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', r3) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r5, 0x0, 0x0) r6 = getpid() ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r6}, {}, 0x37bf, 0x9}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r4, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r5}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_PID={0x8, 0x1c, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4885}, 0x4045) 00:50:11 executing program 0: r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vmci\x00', 0x2, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) fcntl$getown(r0, 0x9) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x80000001, 0x7f, 0x1f, 0x3, 0x6, 0x1f, 0x7], 0x7, 0x800, 0x0, 0xffffffffffffffff}) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000080)={@hyper}) io_submit(0x0, 0x0, &(0x7f00000005c0)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, 0x0}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xa4, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x9, 0x2, 0xb}, @fda={0x66646185, 0x1, 0x0, 0x2f}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/175, 0xaf, 0x1, 0x29}}, &(0x7f0000000180)={0x0, 0x20, 0x40}}}, @register_looper, @increfs_done={0x40106308, 0x1}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1000, 0x2}, @fd={0x66642a85, 0x0, r1}, @flat=@binder={0x73622a85, 0x1000, 0x3}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}], 0x6, 0x0, &(0x7f0000000280)="85873c192fcc"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x3ea) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x10000011) 00:50:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r3, 0x226, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x15}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r0, 0x800, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x8}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40) socket(0x26, 0x4, 0x2) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000180)=0x10000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400101, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x5, 0x1, 0x301, 0x0, 0x0, {0x1, 0x0, 0x8}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x24040040) 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x5c, 0x13, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 500.947687] binder: 1932:1942 ioctl c0306201 0 returned -14 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x108, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x7f, 0x0, &(0x7f0000000040)="135fea84d55e172bff0ec1db46d23eed8bc4b457c22e7e5b22d4972c815429b72d6859b7315ce36ecd157eb20b2bf852f52635e4597fb16610ed5296143d9653bcef1d8cb253e00af16c7730d2f78a2c98de38f7e13ab0d40c53d9861b9772a54e4c18d37301f809ea45d7bae41d924f86e87a0e579aa6dbc0d65e031465cf"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:11 executing program 5: ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f00000001c0)) r0 = socket(0x1e, 0x2, 0x3fffc) sendto$l2tp6(r0, &(0x7f0000000000)="10a71e2fd65a88279bf13b230132d1f3b2a250bea6b5c0e0201a88b41e61c555edb12a8530275b9444514272524993cb575eac06c6617b8889a842cf960fd4bdc052ab749ea12691e8b019ca9a192b86ffefe6e6626f8cdda0e08e3bef01b4ac8b11f847834823eebfe226e76ad6aebba38ae76cdf0bfa126218f92ae0f6b8ee7e0f5e3cf18198043dd5cb52b83a300164f0fc8562b809341dbca9f7658d52daabc560f3b2e448cd7d7a7897659df8adeac01354be5fbbe885e2ab783e7172a9dd10140cb17e6d7f6e602f", 0xcb, 0x4048817, &(0x7f0000000100)={0xa, 0x0, 0x1c00, @loopback, 0x4, 0x1}, 0x20) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) bind$l2tp6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @empty, 0x7, 0x1}, 0x20) socket$l2tp6(0xa, 0x2, 0x73) 00:50:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x0, 0x300, 0x70bd25, 0x800, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x14}, 0x80) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp=r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8d0}, 0x24000000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x108, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 501.041075] binder: 1968:1977 ioctl c0306201 0 returned -14 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) 00:50:11 executing program 0: bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0xc880}, 0x24044013) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:11 executing program 5: sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0202}}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x3c}}, 0x4000) socket(0x28, 0x2, 0x5) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000000)='net_prio.ifpriomap\x00', 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080)='nl802154\x00', 0xffffffffffffffff) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x108, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_CCA_ED_LEVEL={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x78}, 0x1, 0x0, 0x0, 0x40044}, 0x0) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$l2tp6(0xa, 0x2, 0x73) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r2, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x90}, 0x808) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:11 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = socket(0x26, 0x5, 0x2624) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x1, 0x2, 0x301, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004181}, 0x20000000) write$cgroup_freezer_state(r0, &(0x7f0000000000)='FROZEN\x00', 0x7) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x2) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x44, 0x0, &(0x7f0000000140)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x4, &(0x7f0000000000), 0x0, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000200)) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x0, r3}) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x20, 0x70bd2c, 0x1000e345, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3996}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x24040800}, 0x4000840) socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="e87d6ce435d8466261578a9138d15c866dd263a17df9a964", @ANYRES16=r1, @ANYBLOB="000228bd7000fbdbdf251c0000000c0006000100000001000000"], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x5, 0x1, 0x5, 0x0, 0x0, {0x3, 0x0, 0x2}, ["", ""]}, 0x71}, 0x1, 0x0, 0x0, 0x24000014}, 0x8008000) 00:50:11 executing program 5: socket(0x26, 0x2, 0xfffffffc) 00:50:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="73e43f157c58aa9e0d9197b419be9a37d513565a12aeb5eba0393601ce01f2336b369fd8d2a0260e2c0860bc020000008f65c4bd3506d9f1b0f83d52ad8f0076bd6a9d09f3c0d87ee5b5e83cf10970473159ecb2774333108276ab55bab61857b87af08d239dff31ef9f4162f036f4e6cde94918682066e718a3eda3c61f7f555aedc0acaa64130eb2a07e7a4a7713e5b9e37f48974f4c2079736f5470f9c1", @ANYRES64=0x0], 0x0, 0x0, 0x0}) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/current\x00', 0x2, 0x0) 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:11 executing program 5: socket(0x26, 0x4, 0x0) 00:50:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0xc, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs], 0x0, 0x0, 0x0}) 00:50:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x84}, 0x0) 00:50:11 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x200000, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x3}) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000040)=[0x9, 0x1e33d800], 0x2, 0x100800, 0x0, 0xffffffffffffffff}) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x4000000) [ 501.423937] binder: 2037:2042 unknown command 356508787 [ 501.454912] binder: 2037:2042 ioctl c0306201 20000800 returned -22 00:50:11 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x5000000}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040801}, 0x4000040) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0xc, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs], 0x0, 0x0, 0x0}) 00:50:12 executing program 5: socket(0x26, 0x5, 0x0) r0 = perf_event_open$cgroup(&(0x7f0000000000)={0x1, 0x70, 0x8, 0x0, 0x4, 0x7f, 0x0, 0x100000000, 0x1010, 0x16, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x8, 0x5, @perf_config_ext={0x4, 0x10000}, 0x0, 0x1, 0x3f, 0x5, 0x7, 0x1c3, 0x40}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x8) socket(0x5, 0x6, 0x6) mmap$perf(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xc, 0x10, r0, 0xe5e3) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 1: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x70, r0, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xf}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xc}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xf}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0x5}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x70}, 0x1, 0x0, 0x0, 0x81}, 0x40) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000002300080029bd7000fbdbdf25000000001c00040002004e244e20000000000000000000000000004000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4c024}, 0x4000) r2 = socket(0x2, 0x6, 0x80000001) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, 0x0, 0x100, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xfa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000080}, 0x4800) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x7e) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x2) write$input_event(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0xea60}, 0x1, 0x401, 0xffffff00}, 0x18) 00:50:12 executing program 0: r0 = gettid() getpgid(r0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0xc, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs], 0x0, 0x0, 0x0}) 00:50:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00c\b\x00', @ANYRES64=0x0], 0x0, 0x0, 0x0}) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000240)={'a', ' *:* ', 'm\x00'}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x60, 0x0, &(0x7f0000000140)=[@free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x4, 0x2, 0x11}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}, 0x1000}, @enter_looper, @exit_looper], 0x35, 0x0, &(0x7f00000001c0)="6b8b2ecd49cda4137245c3aad28142f138d84842edde2000ec30503a8aae31648b92fa4a80de45fd4f97411ab430649b86f7bd19bd"}) 00:50:12 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000001240)={0x398c, 0x7, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_RULE_EXPRESSIONS={0x2b4, 0x4, 0x0, 0x1, [{0xb0, 0x1, 0x0, 0x1, [@reject={{0xb, 0x1, 'reject\x00'}, @void}, @log={{0x8, 0x1, 'log\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0x7db7}, @NFTA_LOG_PREFIX={0x15, 0x2, 0x1, 0x0, '/dev/dlm-monitor\x00'}, @NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0x2b}, @NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0xe61}, @NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x6}]}}, @tproxy={{0xb, 0x1, 'tproxy\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x17}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x17}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xe}]}}, @flow_offload={{0x11, 0x1, 'flow_offload\x00'}, @void}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x15}]}}]}, {0x10, 0x1, 0x0, 0x1, [@quota={{0xa, 0x1, 'quota\x00'}, @void}]}, {0x164, 0x1, 0x0, 0x1, [@hash={{0x9, 0x1, 'hash\x00'}, @void}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @void}, @dup={{0x8, 0x1, 'dup\x00'}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x1}]}}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xf3}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x1}]}}, @reject={{0xb, 0x1, 'reject\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x6}, @NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0xfc}, @NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3f}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x1}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x1}]}}, @masq={{0x9, 0x1, 'masq\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_MASQ_REG_PROTO_MIN={0x8}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x30}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0xf}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x12}]}}, @range={{0xa, 0x1, 'range\x00'}, @void}, @payload={{0xc, 0x1, 'payload\x00'}, @void}, @rt={{0x7, 0x1, 'rt\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xe}]}}]}, {0x8c, 0x1, 0x0, 0x1, [@payload={{0xc, 0x1, 'payload\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x5183}]}}, @range={{0xa, 0x1, 'range\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8}]}}, @ct={{0x7, 0x1, 'ct\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}]}}, @notrack={{0xc, 0x1, 'notrack\x00'}, @val={0x4, 0x2, 0x0, 0x1, [""]}}, @lookup={{0xb, 0x1, 'lookup\x00'}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}}, @nat={{0x8, 0x1, 'nat\x00'}, @void}]}]}, @NFTA_RULE_EXPRESSIONS={0x1f50, 0x4, 0x0, 0x1, [{0x148, 0x1, 0x0, 0x1, [@tproxy={{0xb, 0x1, 'tproxy\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x15}]}}, @connlimit={{0xe, 0x1, 'connlimit\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x8000}, @NFTA_CONNLIMIT_FLAGS={0x8}]}}, @socket={{0xb, 0x1, 'socket\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SOCKET_KEY={0x8}]}}, @fwd={{0x8, 0x1, 'fwd\x00'}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}]}}, @tproxy={{0xb, 0x1, 'tproxy\x00'}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x14}]}}, @target={{0xb, 0x1, 'target\x00'}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xa, 0x1, '\\\\$m[\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x69af}]}}]}, {0x648, 0x1, 0x0, 0x1, [@dup={{0x8, 0x1, 'dup\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xf}]}}, @bitwise={{0xc, 0x1, 'bitwise\x00'}, @val={0x220, 0x2, 0x0, 0x1, [@NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_BITWISE_XOR={0x20c, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0xcb, 0x1, "10dc7c3b8e4515ebca93affd12b62f0be3860c69778275fc92e4bdc0cd31a9504358b8831f353ff11a2243cc4dc534beb7c89d9014f5ee7d0735a8015404baa26cfe79e79f070d4703557fffa4673d8cd7811c550746a3290933feee8a95bcb935e921e24b064e60bb092db8e4eb1ad403725e8bd3bd30ed376cba693da1b96b0cd26727f2f0cd0a187a3780a1af2d212a5c2e3bf86b7759a049f18606f673124e7f49eefa4a65c5b68b6e0748b537fcd671dd5d287170fda95e13004b9eaacf9343bc8f252c53"}, @NFTA_DATA_VALUE={0xea, 0x1, "3149ac66cb93ce7d9556a96a795e604e88e8281709eaa8b292b1d8821c03d04aa97daccabf5d40667e4e805d8ebbe923b01b13ba94d1e9a8b90a3546795cd762f93c0baceec4c4dbca3fc5ba9817a6872d53e0ed047187f93abb162b405a9d163f2945668e7f8b96ab523602473a9d5f169bddfc41d0d1480021d49295cda5cdaeff0be262ca588a6a6127156d88d68fca3c101777232e83214491249f15e68e54f03abb0aa211e6ec08e28bb100290073230e8cdfb1a891b96cda4655f71c6f5df9c0726f84935690bfe62142af7cb571f0bf30fb06964de7fb6ac8c19e69c74f9d7e7fcc2c"}, @NFTA_DATA_VALUE={0x4b, 0x1, "8c080439d1820325f410dd4a6380a96b41d68eb90abd50985eb66ff51924a1a5c36c3fb7074ed35530310870bc76e91115eb70b2c2cb31e56054a13fa665f5e5817cafd540e32d"}, @NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x1000}]}}, @dup={{0x8, 0x1, 'dup\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x9}]}}, @ct={{0x7, 0x1, 'ct\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x9}]}}, @log={{0x8, 0x1, 'log\x00'}, @void}, @bitwise={{0xc, 0x1, 'bitwise\x00'}, @val={0x360, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x1f}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x1f}, @NFTA_BITWISE_XOR={0xa8, 0x5, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x7c, 0x1, "9a18138d147545ecf053a586768480e49a7b50b71526aa13307376ca23ff86a95fc2233d1cdc440eeee529792f836b2a73e7151732039cf26626d519b12e4f4feba56c1c805489c4640d3cb99f90f95b82bfba4996193be20a30af53d7dc71cd3a5d5f272a4c798d86673c0fd832ff8ed28b5e461f8ea615"}]}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0xa0, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_BITWISE_XOR={0x1f4, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x24, 0x1, "03153f647cd42f218135a5b3ad3e7defbec4dd0ab29564a3fb9e3f149e465f14"}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xe1, 0x1, "c31901bdafb4a88859c296e71062aeaf6d43be0268268a6ca8f5ecc78147b28e4c66e75ffe04eb978b3095d43a913f0a3a6f4a4874705b0afe59d7d6c1ea1774598e2b21927e5d516114c6ff481f0ab5006010a7310c9188553d0887741357e655de21095b9dd43f0ce8b6fef324540fe9592eff8494578b5412cf67f76c6af632979a2f25beb652431d37c60410dcae9ba9ab65fc8bad6e5831be2034871980d80c8073deaebdcd393e9d70301d4166e2e380e52845b19b60048ff43f9b3920002dcc4df8f7170596c576222350386ccdf9bc42c6016dbd638d7b91ef"}, @NFTA_DATA_VALUE={0x95, 0x1, "d57b648662596443718ff3d58fcc2e4111e1e5e5c11f3ded7da6e5a7c543f8a92274f0a488fa6de74bd60df494555e31144bc329ee7549163b6e86e72e9408bf0eb97e4c3580d8696391a5473937ab290a9d1ae12fa67916bf4d6a15ab34ae575f60a773f8fd657facf0721966c34534973e13d2e716c62102b9e8af03108220caf0c726cd6b5f6db7da4bf0c9b4903b80"}]}]}}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xfffffffa}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}}]}, {0xf0, 0x1, 0x0, 0x1, [@rt={{0x7, 0x1, 'rt\x00'}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x10}]}}, @counter={{0xc, 0x1, 'counter\x00'}, @void}, @limit={{0xa, 0x1, 'limit\x00'}, @void}, @payload={{0xc, 0x1, 'payload\x00'}, @void}, @range={{0xa, 0x1, 'range\x00'}, @void}, @objref={{0xb, 0x1, 'objref\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x15}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x9}]}}, @ct={{0x7, 0x1, 'ct\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_CT_DIRECTION={0x5}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x11}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x11}]}}, @dynset={{0xb, 0x1, 'dynset\x00'}, @void}, @range={{0xa, 0x1, 'range\x00'}, @void}, @limit={{0xa, 0x1, 'limit\x00'}, @void}]}, {0xc, 0x1, 0x0, 0x1, [@rt={{0x7, 0x1, 'rt\x00'}, @void}]}, {0x58, 0x1, 0x0, 0x1, [@quota={{0xa, 0x1, 'quota\x00'}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x476}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x4e}]}}, @payload={{0xc, 0x1, 'payload\x00'}, @void}, @limit={{0xa, 0x1, 'limit\x00'}, @void}]}, {0xb0, 0x1, 0x0, 0x1, [@dup_ipv4={{0x8, 0x1, 'dup\x00'}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_DUP_SREG_ADDR={0x8}]}}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x7}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x7}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x3b}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xc}]}}, @bitwise={{0xc, 0x1, 'bitwise\x00'}, @void}, @payload={{0xc, 0x1, 'payload\x00'}, @void}]}, {0x1374, 0x1, 0x0, 0x1, [@bitwise={{0xc, 0x1, 'bitwise\x00'}, @val={0xcc, 0x2, 0x0, 0x1, [@NFTA_BITWISE_MASK={0xb0, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0xab, 0x1, "2cbab99446c610e859a68c54654bc4ed9522b5f49af80b401b466501709aab86d62426d5d99b50c27c3f4edb8550639a2aa11a6973424d846edc3c9be51ae1290f5681d0b6b60eb3082dfd0a03898504c19e9ce39f3cdc6fa49b4ae99d4b17ccd133aff4bedcd6c6b1c910bb0c43396cec56b49305f796a284ee5c7b193537b91c0c7ebfe3c71a7a8b8c8ee0f9e4460b7e4658e45ffa9f66bfd7383f2acc3b33464fec0131b002"}]}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x3}]}}, @immediate={{0xe, 0x1, 'immediate\x00'}, @val={0x1278, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x1218, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xee, 0x1, "0f3bcb7635257fbd61907043d40736e6eae621574138c1ab3e3489ecabe89bf34a9d955f3dde8dd8803d09e6d33755f16760d75e341a840594ceffa6aac90784e122dd81b32bf4aa399f75eb46503c7895ca5c515dc5839e7b51f5ebeffb25fc24b71b15c55f8b3577b1fa0f485c06820190891c09f7cdb7cfb4dd3950fe550eaaf3e6aaa343b11a287808e86c4c23eaba3200c475fe97ec97bea38f0234f3e4803b247ed67a7b7a08df4cd8cc6d1af3cf0645a7ed58ada9f2e2d6d660a1d26b190794c7460ea7ca986b55f29a968e412313baaf6a055186b797fb9ac422e90f5b082d9725addda582f6"}, @NFTA_DATA_VALUE={0xd4, 0x1, "fc5861efc1c0a4f1990a053eecba51ffe84784487ad24a016136a2d2fe2da04ca97039bcb788382f6b6cf19176719402ed35388718535b30c9784cc6862cdfe3142f3d7c5d060cad20bc93b94d20e71f9c043fa965bf93b12d79c2910a3d5a28defc2c35035fe328883f178c8e45f1fe0079f269baef606560efa038772f2d1b67caf2cdef1307000a8826baf86515531a2db590fb48000c67835c09f409929cd5bbdb3f5030971765ed669d0b2140bde2c5731c0bda000786424579b32809cd80d1fda0bd245600ca6b7a7779e6d68d"}, @NFTA_DATA_VALUE={0x1004, 0x1, "f492c3d40ce62de172892228bb9df44419ab531d6f1791367a2e7d00835e4ab5efeed2ce64cdce7417a8ec32cedf613669e9e9bc62a7a325c03ac892fbe5dd1e3cbd27d1c3214a6b7935c602c10fd409b344e5a84121185711004749d6f893efc862fca69f37e16372c5b3ef5525ca70734537646a6cf74e933863c6506f7c7e007da703c001f6737a7640d656a9600acf4ef9dcb33b9cc1286a63aa72615b831d45b9f982eb94c52cdce521d134a17c9a9e9ae9dc4c20132277b9fd2a30ac7cec883e146ff9f14e567db4f28beaaa804d94da672907d2fb8d74bfb33c8e6b45dad1b7dbd8acee4899d6873f16d1e28f787b597c2e3575d9252e849ce6c300485acdb1c57bc2d48069d71ec03994ac51e0c347a00d5ce483f01d7c09d25ee0a65e42235c06dc63b42135607dc5f85ce1a286ad755e6602c15898e310b0a459dcb171c936942f14bd1990410d39e83e8bc72ea0fea723c31dd7933c5ac9081e7bd34baf3b9adcb8a798351302f841fee5757ffaf741645acb72cecde1877bd3a816f63cf2b1db982c1f8f91c5b5113020709a87ac41adbc487362bec41ed17baa0c30859caeb2683d0ed2da9c6729ea93b388b1ab8af95d28c819111da9ea87fcac6416e6af6379fff737a7f7798737b92a0c44d2cdbd1ad86df381f49bf0aa3e317b0e9df833442d236c71ebe940ed4f6e6310ce6767f2e04799507aa8d1c042f5d86bfab4a664a2f58cf97769d6d708486456d87f7327ead38305d35035ddac5d4847a3a90266771fc6d85848228f77bec42f89f912fda47104fad49ad0d25ce929c9f3ef118f0b8fd969e1b16dc9afdc7cdd43ad0d16eb4b4fadccc1bc11331e8b02ace4d40436a7fabbf8f7be4d372627691f532c1333d51636976043f7edd3474e5ec50fd971735f019cc0e8b23d92ffb29f9954015867e7218caa932f6cdd976b4ace8c19367d396480d4f2da2eeef1d8c7bec70a7a3d561cb095fb19b2f6af2f51e26c5cd0ee7c096643745bfb42e4c88152a7b10c385afdf766f5063736d11005d4c331944faec9d89dfbfb798d2b58c1d895f56c978717e34c44c30b95275c93bafb2d1ebc2cbb22ae4a4d5be08fc24846d5b98719af8a23a81553c3908778c6d170c17e67877591befab52b4037b071aa7cfdf4ecde7915e7b4676a49759f0836e85a977af94310a57c5f4bd843a5f82864ebb43a137550a5b1b5237d8e415806828d7fc2690fe6606d0ef2f6652c1009c858f55323038e57d865ab7a4a836ffbb7e034683693fb90bc25997481bdacc5c7d1320a5770b1411ac563ae5b3546ceae121ae8a8f45b75e91ef79a7e95136d91aaf0c9ba942e88f36eae7a9d2d73a3766ea2af515814f194e08f31f0a770b63d37cf9fbc5d91e2161c71f17ed67a5debd4d09cca20b308961676d1bd7e52b3900ba4f70d73e7a919a607aa12c7067441d2043e71237e0d36d7779347d2e78c1724f538cd49650c3646fabff77572abbfd5b0bec0a603abdfce7ed0d5594683ec492e71e97b11816839e6a74ed5a9a5efa921615dca6355d503d5cd5a44077029c8a231cb73ebe266be5424433d5a9e8c06e141348bdf267cbafe88d466c0cb2e6c6103c83d5f1c3e196b3b3e09d612704078bb2c7c4cb1e6502370aad37d81f95b5238620a2ecb63190ec23d74acbe55d3600b7339211f0acaa1e08c9fe354e5995e699574b618871c3d829d2a7ae872c751ea85b28becd62a95d5e3bd809fb6aa43b9e5e9b858e982b4d77f4f6c7f90afaa2ea0581d799553ae71a41e6fce5e443bb7be57ca463803f30e3c074cdfccc689dd5c8d47da844894f982d985ce7ebb105a5a22b97a27e9ce26c299b553e8e8127141348cd9683188de8878c8195ccc0e0bbcb70df9b2160450e0db2d0ab48099dd3bc2190c7de2c612ff10ad3e9a5b41a8784017a719e099fd2aedfe029d4884ceeded22352fc19fe4e68b842f57141f90cb5833f57a3f4a85019a38318cadd4e97959fb5ad1695aa3ebafb45210642c57354163001850999910b20a65dc90d64b7b73afaa2baef15267359d10a90a0e7481c3ded3d42e473021e4a666e2655cc8797cd524267a13a2afae344240681b75ed1309645182a5df5852b8377fea12794de179757d82f636942b153351c2b9019e5199373ff8020aa7eaed1de1782de4ac19ccb4652f9d71a44f75de89bd8f43718a163a4932c23227f67cfc3c216a61b36f144d5ab61abecd334ff28ab787ceced217a3f6da2307b402d5b3ed2d69d82b6fc0a40f28e8c2ce338ebd155878a650226b32b3858cd9d90684ef119f9ab2ccf74e4d7f9073e0d0117916269380521852f9587c2a8196595937440507d2e036cf0413c4f80f20df471d247bbb1ebd658bdb6494b810a8789455a3fc31c6892199973804ee1ef3dd1723332e7ec2a1be6756156880d3358fc2d329168b4b42ff61ea5a8dd3b61b96e2b0d4d343692405d899133e91b552ac85c0a482b82347f139c4f0b475f24fb3d5d4b193d22275847baddc8f8c4533aa40e96a07b1ce2c3abf71a401e1d88ea98b3fd2b740e2c358633254d1a2b13b9c1e37e8a6daa715f6fd76ec65de07a5f0a79533a680da504a6cc7fdcf0f8e9a0e3ab2dfa135e62726ec4cacf7a44bc72524d133f729e42730f6b6f8a7033725c91b125b849f36d43498fcf07a477e0fb35fd402aa21f9f4d5867175374db73679856562fe3804c287a52c618a0508090e2272931013128e9843c9b62ac948f0fb0c51d2a514995a7f7e9858475bca10b926d3f0ff3dda3eca3841b1189dec48e0db19c07bb34caf8ee19d85d70765b9c113f12b3d361b179b3356659ad858b7b6ce133d81a72de27d01336a7c9834a10160d8d109af0f5989553add404d0e0201bd3bb042691d9ee93325d88a81deac694751937415264fef199346d24911fa734ff1213713085b402e8758cee54560e9d0617850c2509528ff62c86e0abe60f8a8df151db9fa2731c4e2457fc54522c6236d04a25b378479c0238ca5f9aff3b21242b3ac240d9141fdaa1c274475db753ef99c1814e2a85e4ad246223c7aa505305b10231583ad64e9d3cc2c520c8469c878f01a8506d3949e48223cad0dbd0ce3d560c079ec3dfe58e7d8df128b172489ca672b1dbbe97cebb04bded434a4163d15e48f99f0a7351886c0428c7dbc5a5af14053fc05650288391ab0589dbf13f858f732101752e79f461b5daaf837ffd4f28ff9a064926e5966c7238d41ad365704d402cf3930f2208d3ecc5f41eb1924f16a2f050bdc063f498e595eb66e6f3d71671ec05825b0da7320198864a7dc2424c465a0370d34d941c5e98437f1e6aa75e430740941cfedef163d615a7136cd5a73e7402e7ea2dea071d1c4f9f063af8e75b570877244ea64246d7e88597ef2e5f9f38fe865f473517cbfd98011faad27a077bf29d8a6d537382429e26a4d9b630291fe65cd192ce6a3dcbaec1bbe1ca81a2500ad2dbfe14a40c7887533e2dd17cd89a5a11c34b5508edc1737553237e54e0662f1ef8179db2b935ce3e703eb40bf05898ec52da78ebd0ef9c2f642c0bdf07858be8d0a2feac31fb862ace1868c680a459faf95b05670e4a69af34450a697a392fae41006b2ae22ee9dfad309470312dd0d046933d2a6dcb8a721c733e56d1d7cb599bda3c52095be1878826069af9e3ad8f359073f0df972401b76f061a56b9283b50f6744be5e1e253952be7b7e933fcd939709cb30634c635b2f727e9ddd04de18b2c7b72bf2af716338b443028adbc0778bd730366e7e78fca96f131c0dfbea28947ccb1f61043a69e25b257762c75452d8089ea643e28adb132db080bb8b259791fb71666921ddb23e2c204b755d8527ede36def39767b28462590c3f29637e319ded177d351f2ac942cd3fd63e90a4f3a54bffd670e02e9175ffc63d58836f3af0174ba0f1b7e2bbfbbb0d7757f2c522b535226712c766e8fb7e64de2f6839d077d88368270bebf7d0fb8d2b55e7c77d0c15190825792b437e9edd69c0384431deff414325975027cb873396923e1b722f7bd7579337d2b71da589cc0b58cbf939f229db7f1aa3fef687f5b46d024f10e762f674b9fcb5b9056937d4dcc70c0b424489790a4377d8021dcada2e8e1e557fc551189a91ee0a1a91c62c3e2017151fef84abed2255520cd3479bd44091f01d541b5a498f62013573f55eb6c092440c81edb079d54c0a86ea098c0ea0ac876326c422b63124162cca1d6bbfdcfca125108da6ec2d0f91b2b1f8352dafc2b566a5b90515363ec59bbcc4bbc8cc2b125718de4274a794f847a618d623b564f1f95a45074fc363c4868d5d6d823adec34769319aee75f584ba78470f28412b752580c654dbac5f0f6625ebf34a64dfdf0abece5ec663e969f77a9f35f2bc8b2ebabad030df550b7c239a8ec9227b0ece70cbbdd2ddbdf5fb1fd4262e15f64226fe90f074352e5ee90960023ed41b535f8c0245256e99a9f64d75aa65b5bd1d9f486cb244f38c6feb1668ef92a58829e881c1debd0a121a0410a59ba9c9bd65b78900cf1bcfeee9b458273a00c41f9198745949fd4c9d249df8ed5d395b9ffa02d0bf982286bf98432260b7d9c9f02bc8f2e5d5ff29cc74af6a6cf2cb17c745aa243887659e6bf79692e482c7f3d0290a7228abc958bbd46487f322f1311de9ab9c317d0c7b1258c7d34fb1d1887d3e84a90fc0e7252ae756968b44b335e4a9bcfa166cd902910a57ddc6a76072a672c9624d0e0b64067591dca60c1a93ff68852b0a954f3ef5056f69bdb7e7b961e77b35f65bc1e8c21107273111e6cbe7adb3f39322c0aa3496f16984a255865fd6ba0f81f9277011163fe4868b68169b885f64950a7a9e89dd28952aef7a9df9eeec9e99afd7ec43a43b7259ff71c0b10a4954692961f4ecc927a99a61a6f295a69fa9b2ec3e3663edd04c5ddb9703032088fb6ade03fa02562a0720c23a0067ab3c576a2892760e97aa60ed4ae667e845ab8e540e608107d68f41208920fb3edc6589b8d46497e3be0469ea80570885c0466e9d82e558babd19d87d41e9b1c351e63d89f1f6e1c71cdfb1dccbc07224f491ab7d32771849311410b3e6f4803285dedd77cd48f60232bd19c60bd510355be96f1b521331a2dc114ea151c4d6bf11bf9df94d19e6c3fd4d158283db9d2e53d0d58afdab855c86978484ae9421aabae52d253e1146afc95169a083da96b1c50c4ac5d6d4d3cf208c65c089d5ccf67a831e22e3d0ee87f3c4a32450e227292899976eca8f3ce7cfd7c6012311fcdf7f7b15024bf71ffad7d90bdfc8879d44cc9530aa37116c955ce7305e8cbfb26662bc8b40803c9d9408a3afa18687e71df6e39909af2c1ee5f9ae03408fe07e81c0d77d5d1108829b0bf734dcda52ee50f6657658c4945371a8162ba3eb4476aa1e349fa89adf827d58a60735b6ad89abd632a5c5ac78a67a0a4f4069b695b0adfdf787816c5c438ce89b71137f0ecbd5dcaa0754ed5ba4fda8d5a19c8dffa5494fde021ae4aacf16075404719282e2c06aade11b05b82c4f8bc09cc7541c58cba30ce0966212c67ca32d12c937e488db57a50b89fe40b250f797281110f671098b374948c13adb4960fd3261db2dd5257b959db36222c5e3e76d825b0c1a440e945e9ff320b3414dfee718e7f7ef099a83730e47d2e63ba6ec315dae255ed7640ecc2739d1a73282c5317dcbb6a35b3ac5c74195bb2ec67abc9dce9f1c2481c5fa858d48e19b6fc3116c0802c2409178db254096bf05e54bc"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_IMMEDIATE_DATA={0x4c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}]}}, @connlimit={{0xe, 0x1, 'connlimit\x00'}, @void}]}, {0xb8, 0x1, 0x0, 0x1, [@queue={{0xa, 0x1, 'queue\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_QUEUE_FLAGS={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0xe}, @NFTA_QUEUE_NUM={0x6}]}}, @osf={{0x8, 0x1, 'osf\x00'}, @void}, @flow_offload={{0x11, 0x1, 'flow_offload\x00'}, @void}, @quota={{0xa, 0x1, 'quota\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0xfff}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x2ccc}]}}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2f}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xe}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}]}, {0x18c, 0x1, 0x0, 0x1, [@numgen={{0xb, 0x1, 'numgen\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}}, @objref={{0xb, 0x1, 'objref\x00'}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x13}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x16}]}}, @connlimit={{0xe, 0x1, 'connlimit\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffffffc}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x8b}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}}, @lookup={{0xb, 0x1, 'lookup\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x16}]}}, @redir={{0xa, 0x1, 'redir\x00'}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_REDIR_REG_PROTO_MIN={0x8}]}}, @payload={{0xc, 0x1, 'payload\x00'}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_CSUM_FLAGS={0x8}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x26}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x5}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x1}]}}, @log={{0x8, 0x1, 'log\x00'}, @void}, @nat={{0x8, 0x1, 'nat\x00'}, @void}, @synproxy={{0xd, 0x1, 'synproxy\x00'}, @void}, @fib={{0x8, 0x1, 'fib\x00'}, @void}]}]}, @NFTA_RULE_COMPAT={0x34, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x6c}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x5c}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x87}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0x171c, 0x4, 0x0, 0x1, [{0x78, 0x1, 0x0, 0x1, [@rt={{0x7, 0x1, 'rt\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_RT_DREG={0x8}, @NFTA_RT_KEY={0x8}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_RT_KEY={0x8}]}}, @xfrm={{0x9, 0x1, 'xfrm\x00'}, @void}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @void}]}, {0x1518, 0x1, 0x0, 0x1, [@match={{0xa, 0x1, 'match\x00'}, @void}, @cmp={{0x8, 0x1, 'cmp\x00'}, @val={0x1434, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x132c, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1004, 0x1, "b5411b516680bc24ccb39913d0e981f69e97fda54b94175a9e5956da0e51eedabdb17678534847ea331d719f5527edd310fc56e261aa3e996cc30809078858ccbcb584cf47808be9f91cd8b5d9b099efb7cc8a83ffcfd115a0244839ed95e5db1737c5f3bfa80fc6e02016c2e2d890dcdf63a4226074073854c549ec2bb9cce866abeb9e34bff5c55759eec867833c06469d74d75b3863663434195d832f73c9332b5eff8b41ca2b1868be69ae8cb83cca098c0bf396da6c0b22da3c64da4fd405f877665c60b10957c13584a8c1ec048741d2958820e171909fa762ce797f289a9327f2d0834e8d386b8239a476fa728f0e6d83e7e641dbe4f7ac22d7fad1687694f5bef58bf06616e456f5f8575bebf474146a6b0361d360a24d694c844f35167f2706f93a24b5df409b033a7a81563a090026f07b0e34c6ed261ebb925e9f0af6ed189f060d5b2f0e7bdc41fdc7070ba3649ee762129c8d9c85790c236b0e7c0497e14b57a5b4a49ceddda1afba1056194a29b466e7dde9820e489f429f5c144dc4c5c81ba54128bd2a8ac5d9b9d5725740327276fd614dbabf3cb0c8eb529eb68ad1104b5e3b4b24d87fa9d71e6eb2e3a8de1703689d41d69090a65f3ccc5c233041c4ddd507024ee5c350a46738b833ffb7bdc8f9cf5ef9f52b21c092855f90cab28e5cfe60d1775d530dbecb2e6bed3bcc68dd7b275250c95c5c191e99c3a4b06178b9b924929fb35ad94d2fe0b91145c517adda9d85e8ccad7a96853358a962f32a5aece725811be1dd27c75eafa7768d23ba7a76db77579b590b6dc0811511169453a8c1fb0f3ef7b31f579866504544ad895faf52e0a3abb249637d4827f5cb1ea486df5026af56628d1909a67aa9e37663b1440dfa77fb2e8f8a77c2cc919d72fc511bfb5a2163708c16b0586a30257007b5110530c731131ea5758af62687b3fd60f67d267098ed49b8a21f28398aa0e160ff60935dc6148eb235a677d7678726c949bd57987369373b1c30004590b5cc1529cd4c3a117d1c8ccee3a4d23476b28d51294cc15caf5ec7d922d36726eaf2c33295ead5e1828187ff5acaedc70e3209938f10b978e81556e9a250b0a3f85226c4466ddc1735282234d93177a225c8b6325fbb6d756f669a0c752a3eea130bcc7c87cde3e95a5d4f62f1d69a47107247b2e15db0fb12537efdceee99f8fdd62e8db9a83115f28487cd2c5b0e3acf9eef7694a8d69b020e3458f15c9161cf8077e6829d8ffbdbb2c33088ce80a21d9b199085a9feb276afe5c481c3f38218803017082179dcf6ce2c20a64683d02c7d62e41f810d092fdb25b019ef940ee9c69aed92039f7cbc585834a6b70a85e14596059b4d70fe75ce9e094ef0a08bce6f03b3cbcca038b608935069f4c60eab5a0d3de7f8d700ea37f2fe2523d644aa7314db0ce88971259ab1658fada47772482d0e566d697eb8a0f03ae302a904ca76d04a6920a160d725e2b20cd3917481cd5a29132c302dbb9d60db67d8e8356a1f97142c55e68e3601ebfa9c3fdccc46116c9df4e521f1a8268cbb4f2ca202248c999a02abba0c1531ec42a17f4f11b1b6fac12d6c030b63216541de722125e8aa3b755e6156503188428c015350bcbbbb679d689d7e6d22a21072d8ff5ca35d9711f407dc4557bee36f66da92d987d5c1422c2647192cfb4e679271eb8a30598b2db4c4c22cbf5292586dd70fbab3b370a5ea134159020ad661ffae509a80e9928aa4ff13499e8d004661d5e08d13871f8aff0eec3010c4cdb8ebba9a1a3615606c136eae29eb1e8fad7cf54cab89410a6a91017c8176bbde3cd08ec9374459d2478ea1b3337e0c6bd696b1ba6a302a94bf8ea202940a97134112b25263474196f728764d3eae4a486b447f390c5fe8f871c161edb295edfdda0ecd0466c6bf0a440188cac6a4723025e6863df3b1352e1f29abbc24a3216c1a8f9252234764d87b412e0a84383385553e72561446ed9edc9b30ccd6c6b6cc94b7b7403d63c78838ef6b4b87d9ca7205024872466c15a44af352b8d857ab3ce13d54748bd75d034efbd4585c0bb1831b94ed7f2659ce4802c15d9a5e2fcd86eb49ca697089332a572887a23d34b5cd07eace2ef3b71b02230f4dfec5c04e73c5c824c962a693b837932087c927dff0ee5f323d6a46b478458c947bb759c64340c76b895b944fdbf8fd95a1f83dce1412e387994f198aefd8e3db12b2a94dab7424865246399f2e478b5b433a4b132b64ab0778600fa24fd4de204d4d29e53c479167557eb7d3fcd37daaeb5fd7309f636abb727cd80fed199a6ff2487e45636a08e92f41be270579894a4c1cfbc8031e276324c6a415be018e6d5f3740d59460bd175a8b7f6685b308f0175a0cc7a2c631f6930d847534252cd48c3c2fff572e542feb756bf9ae3e4c9f0cc4ed88987e82bda4863c8d58c47c68d863bf2c16c4fa060ea50e030abd6123b4eb90b70f13ed9d1a252c449bc8bfc5061060d7c63fdfe92ad2504f2df62aec925584a3bdd9a05afe503867d5e45dda3ab4c57546835f4abc6ec3d2e12d094fc03b09ec1eb118d6263d0e05f5c50b3eeea402133014c133211938ab1593d8f725b13fa9930c4a041465ce58292d56788b54ff18cc161e4521af76700e62438d4a396cb993b93cde13dfbfc23d8ed4f92b611bb66c6ff134f3b6d5ab577bbb4ea37055ea1bf91bc253606c53e7941b8cde57b40f0a16d179c76b083b0ce677dcac0e818841d8e0f723b97477d74715f6a2ad4809a2b094355c5acc8fb936adf69a31af60253db492239caa9919d8ea08c3b0e659a32811d4e0ecea150999f386ec109745825536511b5592ace0a6ee2df97aa15d4bc6cb2ddb7eedb47c8b330a4ddfdad2dcc888522f97e7f5992149e2c4ea01c084fb2e14e5d5ae3bb6d1b8b53745654891da70df71163d0bd4a38aa4adf00990d7687b8247af71395c1d4dae7c2359d01b1ae2f027d9353acf24e0d6bde5ffb26f5c301367baf9868fbd4edd41b233f0072b495caf6763eeb59af6bf44a3ffaffa5a25c639a72f9bba3a2476f2683030c950f78a830d41c4833b56cd014cbe005e40806d098cff9b9b72ef5fc7296adf73b51e4adad60e5710eb07c52ad5f3bed0d3403675da8c704b55f100567adde76c0d6c06b1356ab9a854a5a03f197612ca2d27e4d4e1c4af12a3223625bf78ea78ca8b359b8402a916980752be2ce62ba63f6c91dd9bbc1860e9960588064243247cbd5f3a60f422daa95fbf477ddf320031f774c79a909634e5c156a7b272993f07b8d39a2263070032399019f7727c0d8ce17f847f1a48c935c63e8f3ea719a4c40596a874f40c011ce353bedcfb1f10fa030cc277286331f910732c4189bd8c0fb62e649f21cf6aed97899106277a73667505ca7339441cbfeab7fb4e8f1e6112304b0348ad2461c579121af57c60448a8418a4bbb956575b337c7f40f6520da94595d3d7e529c9f1eb7ab3c74236f692fa3ff950471cb9537851fe968e87770cb15315359ccaff1f4e1c6272304a575e4160bd87e0c23463a348109403920be6f07a444034ac442e2f008edacf82014a4352a1a4c00e908e74b3603fb528048636904b5113935f75df39b3d010e4f4b8b21ab907efad5888a0faf0f6dd046fb5c31a117134a96e1eee84068e0c15c151dc99c084376ca1f4b926a1b03cf4d244ddfdd5172cfaeeb762bfb9319bf3e06ff2e115962871983427303399aed7e8984d33a3aa6cc2857bdcd45d2d020db8bb239c0413dbd8a022a3cecef74fb955e446e61c087f0ee8a66497a704df6786dd9578fa74810a42af73f53673c6977b267babf2daf6887b3831f0617ef365ae3ebdac4fcc5d75e618cf2c2de7b749613feeaaa75d3ffcb7b013bcf4fe4688e19cd3ebfb45d156042396418592a2f99a4ee9c46dff4c63fd8b31a495ce9561d28c53f90744dcd01f338df72af8b943381f941e29affbd0f997539f8954fe85fb44bcac6bd7c15ee8517536b390b87cf261be644f24c09802fd28df136708a731979a97fcd521464c915514447f7884e04d87781dc22d4e04a846775288dce2343ed5ba9891308ce384bdebc6fb75bf709ecf2d4109b8031af8f46eae12cbaf09df0d15cd3441a1a746d18487cfc74215718ebdbf671adc0adab3bcc541735c453764ca6636504843aee5f3d64e1d842b8c733eecef818226260332d13193d6927f333e231a3d28818bab5e31ea3c8075656c214c719bc7627ea1613355612ab0d745b91ee1a25bbca1670e0b841ca79b12e7d633a86a321c7e36b03702f3e6841f678d802656a3bf3007b0e58b20a20b172127d1ed6ea5c10aae40be6c2eb0d5335e8e6f70ccb52471e8523617dc7592ad98d2e107a2c07e376ed7a8e4db0fdb33c17ceb2fe6f5fca646397416f9148e2211ded8318165757c91e3ee130279cf239f291cded0bedc795ca7b608b1e1696bcf210bac258f02c3be70bbd6e0697822b8883431b7108bbbf2e5648b163b65ccfa1e8701ddafbf96cbd81293e58893f20a4e42f7d3bcd0c300556d013645a0233539e293313e00a66e9e257141fef41e6d89d5156019b64d5736cb80097b6fe0b2d7e990dcc2a35e60088b33f8f53b9801713527493bea054c7058830eb70ef6bd62c19def8a0220390e13ebeba384318ae24bb4b2ace290736c23fd9a6e0dffca596777afd1dcf121682fd9f1cfe0c8c371f32e6254bd9037db2775b690f0c4dd05ebae6d8465372edd507ca0bd1266989317b25ea6e41479f36a4ade765ec4f82f7b3793e4802e4bdb080978cba1e11b1923b401a1990273bcdba8563a986442c9d817aeca553018e5fcb58eac2625173af8cd0a0ee177f972017452d2ca368608adf4c9ba0eb39a054c6d3348d2ff64f6f3a8482a4114aa0f578a18c5d61b6a28117045d864173a53de4ae46a8476dececb122015c3be91349a9a30b19cc34baf928d187b11abbb05489630125a7cf57f0b2a31840974e2e8d852760e66c956c1d8500353159ec212b1ccdf54ef72c1249812e63338e8140f5d316f1730f86f77d2cc37d8d3e5c2459eb6d42dee403eed74a59f305d874f52536b5966344dea0fe28ef5c4d35ef16b3089a06667367efce68d0a2925cc463a626d243bd0fa3ccb3b81e57b241ac4b1f65d316295c6527956d1db521488de316729ac83e2c209ec069159c3ab474332290a582c6df7f2b13aa5cdd33c3e824efdd82a215abef7f8429a8e88464f4fa256dc842e068cb2723893eac56054ed0e1c4681c16ae3de3d27750ebda6d2f898235a04e7e976448706e12e2151c1bef15b8f2b4dd65497e97af0a222d8812f4d0a7b03a9d4544c7fe0499ea336049020915fd196df559a7c81e9daf01bd54cf57bbedb0900711898b8ac0cd31715f33013e812807724aca3b7ca51e7daa78739819f2f63359e81448c32e6ee262a1c8dc5a731430da018277d5168428fbe90db864b6094ff35be20372bcae0ca1fce4aee3e41af5d25984099d6170d4a5fdb5a254d11a96c5adc8880ee2ec70b9887e8ae90cc3e625f20b9f005a2b74335f10e0a58f88c4ca633fc1b68e61753e3226ba8df9b49f14bfddd60a729320b6b1cd3cb9d963d87f2510faaa141729dbf43b9ec3552e2f2febb2eaacb776bf3ab30f518941123a386fd02f12917a7c01a8fd4407a949d4b2c3f1c9fb5ac84516aa7bba6ea3c5273ed8e90b784fe839ad2f430c15d4dcedf5b5df974a903ad57d109dc8ec4a7a396444b8e25c9131b05c6e5a47f9384b2246b9a"}, @NFTA_DATA_VALUE={0xee, 0x1, "5268d17bf85396f755f278b6d7df14a56bdb21d3b150cb27814d14d2a5aef899e22f6523f6ba8cbf03202351afd671b772a6682efc59c75e56f697703a7fdf7e8d318016cd9330221f493152800950f55e6e388b956542a1dcd2ae54b7c701adcddd259e82beba7fa14d945f9036ff3f9288447a63bf2cda37b6158a112db975454e52f44846027f7047e46b6ad14fff51a67e41f0d96637c4be8d90901c668d617039171e97e8a8457811ff851d8cf3d2dc971ec418f4e5ac7303934becc2ee034db8df99a702953edd79c26c88e9c2d4b9a594d10b96106be5d02b450d45d2e9744b0d458b535a92cd"}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x9b, 0x1, "efd7baf99ae023215fe13aa5ed2cc95ba3cdd0c6cb5b98c8cbe5c7d2c5becf6d0f90dbf8bf629957ed4155f1f8d9448f3c9136f7a42717b0e1ba83781baedbabcbcc529946c1144c3e7cbe5727fe14491fcae45dfa47c9ff6916a13d61c2e4e1e7ef1651659a19a88e6c7a6340a6106ef5977ae2994d921b3d21eb9f9354dfa785432a0e9289627a90716db8aa0416a3618060287e5216"}, @NFTA_DATA_VALUE={0x67, 0x1, "0f323af8ba343329988477739d1ada47d57dd19f839321c79a68859156b8bc7041da65eaae9df9ba16791ff7f167db938a8a067b43eaa53a807d6c75d8611ea0b6060691856c9822de2de7a56b2047a5b72ba7e7b5abbc2bc5d3a0f8acc7eef9e95e44"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x32, 0x1, "7e9a875d85cf7bbb1a7abc38893764389b0be9a256155930c828c03470850ac4a60a246719c371490361c4d46d7a"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_CMP_DATA={0x104, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xd7, 0x1, "450c754fbb7f1748d1c3cb28bffd7f90bd36ecc958bcd32819d50c880bbf89ddc84b2235b1392b95b70577e247fedfa17f45fa7ff9bcb9340925fc4a4b3cffacae7dffd613c1cf3e00cd4d12f9d447c520e5962c28a10b7e1f975fa0ebd9f2db35a21634a66b3019e493b774ac2fcb9e20a22d22a5e084e5aad4a0b5afd2d2934fe308ba3b43fc4da5931c5c95654d742f68d31df27326213ede4f1cc8471aad7f8d9f855fa51243dbcd0308734437582ae243502dce582fbce8877245a7c9a7ccea120debf15acc755e44f2a4db9c31ecce50"}]}]}}, @reject={{0xb, 0x1, 'reject\x00'}, @val={0x4}}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x41ac28d6}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x401}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x7}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x4}]}}, @nat={{0x8, 0x1, 'nat\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_NAT_FLAGS={0x8, 0x7, 0x1, 0x0, 0x11}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x8}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x12}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_NAT_FLAGS={0x8, 0x7, 0x1, 0x0, 0x26}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x13}]}}]}, {0x74, 0x1, 0x0, 0x1, [@rt={{0x7, 0x1, 'rt\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x16}]}}, @exthdr={{0xb, 0x1, 'exthdr\x00'}, @void}, @lookup={{0xb, 0x1, 'lookup\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_FLAGS={0x8}, @NFTA_LOOKUP_FLAGS={0x8}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}]}}]}, {0x18, 0x1, 0x0, 0x1, [@tunnel={{0xb, 0x1, 'tunnel\x00'}, @void}, @log={{0x8, 0x1, 'log\x00'}, @void}]}, {0x68, 0x1, 0x0, 0x1, [@queue={{0xa, 0x1, 'queue\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x5}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0x8}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0xffe0}]}}, @osf={{0x8, 0x1, 'osf\x00'}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}, @notrack={{0xc, 0x1, 'notrack\x00'}, @val={0x4, 0x2, 0x0, 0x1, ["", "", "", ""]}}, @payload={{0xc, 0x1, 'payload\x00'}, @void}, @bitwise={{0xc, 0x1, 'bitwise\x00'}, @void}]}, {0x94, 0x1, 0x0, 0x1, [@objref={{0xb, 0x1, 'objref\x00'}, @void}, @connlimit={{0xe, 0x1, 'connlimit\x00'}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}]}}, @fib={{0x8, 0x1, 'fib\x00'}, @void}, @reject={{0xb, 0x1, 'reject\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x4}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3f}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x34}]}}, @fwd={{0x8, 0x1, 'fwd\x00'}, @void}, @notrack={{0xc, 0x1, 'notrack\x00'}, @void}, @meta={{0x9, 0x1, 'meta\x00'}, @void}]}]}, @NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}]}]}, 0x398c}, 0x1, 0x0, 0x0, 0x4020}, 0x10) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000040)={0x6, 0xffff, {0x54, 0x2, 0xffff, {0xe000, 0xfffd}, {0x3, 0x3ff}, @cond=[{0x7, 0x1f, 0x9, 0xff79, 0xf90, 0x6}, {0x4c, 0x1ff, 0x5, 0x5d86, 0x8, 0x3}]}, {0x51, 0x101, 0xd9, {0x8, 0x7}, {0x9, 0x4}, @period={0x5b, 0x6, 0x2, 0xfff7, 0x3ff, {0x6, 0x2, 0xfff9, 0xb67}, 0x4, &(0x7f0000000000)=[0xd91, 0x81, 0x4, 0xfff]}}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 5: socket(0x3, 0x5, 0x1ff) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x50, 0x0, &(0x7f0000001500)=[@register_looper, @decrefs, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 501.704049] binder: 2080:2084 unknown command 549632 [ 501.720039] binder: 2080:2084 ioctl c0306201 20000800 returned -22 00:50:12 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x8000, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000480)}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 5: r0 = socket(0x26, 0x5, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40, 0x0) r1 = socket(0x29, 0x5, 0x3) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) recvfrom$l2tp(r1, &(0x7f0000000140)=""/78, 0xfffffffffffffe52, 0x20012001, &(0x7f0000000100)={0x2, 0x0, @broadcast}, 0x10) socket$l2tp(0x2, 0x2, 0x73) 00:50:12 executing program 1: capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x800, 0x0, 0x5, 0xc9d, 0x7, 0xe151}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00', 0xffffffffffffffff) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB='stack Adev/dlm-monitor\x00'], 0x17) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000020c84789c613cc914783fd1a4279bb2e59d861a86c53515fe119c4c57222597590a46f686102ebe706000000e877d51da879a303547731164e2e2195527de6f4e138b4844caeeb0702f9e0bd67ba46f59f645932ff6e6f4011fa4542947c2e1e0004da70bcf9e61e3e199920495a4219fdb9491a8feebfff0ae251c0713e05c454efde72bc7305000000d87dc199ea6c5c92ac0dd2de3f237700000000000000", @ANYRES16=r1, @ANYBLOB="100025bd7000fcdbdf25000000000800110001000000050012008000000014001f00fe80000000000000000000000000000c"], 0x38}}, 0x4) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x48, 0x0, &(0x7f0000001500)=[@register_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 501.754901] binder: 2080:2084 unknown command 549632 [ 501.773761] binder: 2080:2084 ioctl c0306201 20000800 returned -22 00:50:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x88, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x21, 0x3}, @NL802154_ATTR_SEC_OUT_KEY_ID={0x50, 0x20, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x100000001}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x81bd}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_ENABLED={0x5}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000080}, 0x40040) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000200)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000240)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000004}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x34, 0x0, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0x68051) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000480)}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 5: r0 = socket(0x1d, 0x5, 0xfffffffe) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$can_raw(r2, 0xfffffffffffffffe, 0x10) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)={0x1c8, 0x1, 0x2, 0x801, 0x0, 0x0, {0x5, 0x0, 0x7}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_NAT={0xb0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x48, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3d}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}, @CTA_EXPECT_MASK={0xa8, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private2={0xfc, 0x2, [], 0x1}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, [], 0x3c}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x20000800}, 0x4050) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x1a8, 0x3, 0x1, 0x3, 0x0, 0x0, {0x5, 0x0, 0x2}, [@CTA_NAT_DST={0x7c, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @local}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x40}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @remote}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V4_MINIP={0x8, 0x1, @broadcast}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2={0xfc, 0x2, [], 0x1}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @loopback}]}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7fff}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xe4f}, @CTA_TUPLE_MASTER={0xac, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, [], 0x44}}, {0x14, 0x4, @dev={0xfe, 0x80, [], 0x15}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}]}, @CTA_TUPLE_REPLY={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x11}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20000004}, 0x4) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000580)='/dev/dlm-monitor\x00', 0x800, 0x0) r5 = getpgid(0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f00000005c0)={0x3, 0x4, {0xffffffffffffffff}, {0xee00}, 0x4, 0x8000}) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000600)={0x3, 0x1c000, {r5}, {r6}, 0x9, 0xb56}) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r7, 0x0, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000000)={0x20, {0x94f7, 0x2, 0x6, 0x1, 0x56000000, 0x7ff}}) 00:50:12 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) io_submit(0x0, 0x0, &(0x7f0000000040)) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x44, 0x0, &(0x7f0000001500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) getpeername$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x20) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000480)}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 5: getitimer(0x3, &(0x7f0000000000)) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x44, 0x0, &(0x7f0000001500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:12 executing program 0: sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8110000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)={0x268, 0x0, 0x5, 0x201, 0x0, 0x0, {0x6, 0x0, 0xa}, [{{0x254, 0x1, {{0x1, 0x7}, 0x1, 0x80, 0x781, 0x7, 0x1e, 'syz0\x00', "b7a947f39817d793bc9cdedcdb576b346322148e1ac2dd8d1196065f73da9504", "f149a7842db69acf4f1b545c3ca9311cbe60aaa207ae66b80748f9f9f5301788", [{0x40, 0x8, {0x3, 0x3}}, {0x7fff, 0x7, {0x0, 0x6}}, {0x7, 0x63c8, {0x0, 0xfffffff8}}, {0x2, 0x6, {0x0, 0x5}}, {0x0, 0x4546, {0x1, 0x1f}}, {0x2, 0x20, {0x0, 0x7}}, {0x0, 0x280, {0x3, 0x7}}, {0x7f, 0x1, {0x3, 0x5}}, {0xf951, 0x80, {0x2, 0x200}}, {0x0, 0x8000, {0x2, 0xffff}}, {0x1f, 0x3, {0x1, 0x2}}, {0x3, 0x5, {0x2, 0x10001}}, {0x800, 0x4, {0x1, 0x7fffffff}}, {0x6, 0x8, {0x1, 0x38b}}, {0x40, 0x0, {0x3, 0x6}}, {0x2, 0x0, {0x0, 0x2}}, {0x7, 0x8, {0x3, 0x366c8fc6}}, {0x71, 0xa0, {0x2, 0x9}}, {0x0, 0x7ff, {0x2, 0x9c}}, {0x4, 0x0, {0x1, 0x31}}, {0x426, 0x7, {0x1, 0x401}}, {0x0, 0x6, {0x1, 0x8}}, {0x79de, 0xe9a, {0x2, 0x1f}}, {0x8, 0x0, {0x2, 0x3}}, {0x0, 0x7, {0x1, 0x9}}, {0xfffa, 0x6, {0x1, 0x80}}, {0xfe, 0xffe0, {0x2, 0x6}}, {0x4a, 0x0, {0x0, 0x6}}, {0x3, 0x6, {0x3, 0xfffff000}}, {0x40, 0x4, {0x1, 0x1000}}, {0x401, 0x7, {0x0, 0x1}}, {0x6, 0x46f}, {0x3, 0x40, {0x3, 0x2}}, {0x20, 0x1ff, {0x0, 0xffffff01}}, {0x888e, 0xfff, {0x0, 0xfffffffb}}, {0x5, 0x8, {0x0, 0x7d6a}}, {0x8001, 0x8000, {0x2, 0x80000000}}, {0x200, 0x8, {0x0, 0x4}}, {0x0, 0x8000, {0x2, 0x1}}, {0xfd, 0xad29, {0x3, 0x62d6}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x0, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 5: socket(0x26, 0x2, 0xfffffff9) 00:50:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:12 executing program 1: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="140429bd7000fbdbdf251100000008000300", @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB="050012000000000008000300", @ANYRES32=r3, @ANYBLOB="ba46126286910f5e590a36f2376142b4a219052b11b79a3d7417be863f149eea6534fbdb502cbf4249cb1ffcfac371b03120e83f46ead38856b6e66cc3a18a2d7e951a1792"], 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200025bd7000fedbdf25200000000c000600000000000000000008000300", @ANYRES32=r0, @ANYBLOB="0c000600030000000000000008000300", @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=r4, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="2c002280050001001f0000000500010003000000050001001f0000050004000100000005000400000000001f090d81d7dd50a886e1cf7d9735b72002b235d903753727d80618fc4fae661be18bf2635de84d6ae6362c7177e74f6dde73228978d7ab1b4bfb04c733b0"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x4000) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x50, 0x0, &(0x7f0000000140)=[@enter_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000001c0)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001680)={0x44, 0x0, &(0x7f0000001500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x0, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 5: socket(0x28, 0x8000d, 0x0) 00:50:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) socketpair(0xb, 0x2, 0x8000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r3, 0x5502) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000680)={'syz1\x00', {0x0, 0x7, 0x1, 0x5}, 0x11, [0x0, 0x9, 0x6, 0x3, 0x0, 0x200, 0x8, 0x4, 0x37e4, 0x7ff, 0x3, 0x0, 0x6, 0x80000000, 0x6, 0x100, 0x1a, 0xfffffffc, 0x100, 0x7ff, 0x1, 0x93, 0x1000, 0x7ff, 0x3, 0x0, 0x1, 0x7, 0x1, 0x80000001, 0x1, 0x3f, 0x1, 0x401, 0x10100, 0x2, 0x0, 0x7, 0xffffff01, 0xffffffff, 0x81, 0x3ff, 0x9, 0x7, 0xffff, 0x0, 0x3ff, 0xa09, 0x2, 0x1, 0x0, 0x9, 0x96ac, 0x0, 0x1, 0x2, 0x7fff, 0x7, 0x20, 0x9, 0x9ac1, 0x8, 0x80, 0x5], [0x9, 0xfd, 0x9b9, 0x3ff, 0x0, 0x4, 0x5, 0x7fffffff, 0xffffffe1, 0x4, 0x0, 0x0, 0x2, 0xd38, 0x3, 0x9, 0x7f, 0x5a32, 0x1, 0xcef0, 0x6, 0xfffffffd, 0x5, 0xffffffff, 0x8, 0x9, 0x2, 0x7, 0x537, 0x6, 0x5, 0x20, 0xbd6, 0x16, 0x2, 0x4, 0xd87, 0x1, 0x2, 0x1, 0xe8000000, 0x0, 0x3f, 0x6, 0x4, 0x80000000, 0x10000, 0x40, 0x6, 0xd8, 0x3, 0x7, 0x4, 0x7, 0x5ab1, 0x10001, 0x8001, 0x8, 0x401, 0x3, 0x7, 0x401, 0x67e5, 0x9], [0x6, 0x8000, 0x3, 0x2, 0x8, 0x4cc, 0x3ff, 0x2, 0x9, 0xf121, 0x8, 0xfff, 0x2, 0x401, 0x6, 0x0, 0x5, 0x6, 0x69b5, 0x1, 0x2, 0x6b1f, 0x3e, 0x6c000000, 0x101, 0xff, 0x58, 0x5, 0xffffffff, 0x20, 0x93, 0x8, 0x7, 0xb57, 0x1, 0x17, 0x7fffffff, 0x1f, 0xfffffff8, 0x81, 0x1, 0xffffffff, 0xfffffffe, 0x1, 0x8000, 0xf8, 0x1, 0xf7, 0x5, 0x0, 0x8000, 0x40, 0x9, 0x2f8, 0x80000001, 0x6, 0x1000, 0x9, 0x1, 0xe4, 0x800, 0x800, 0x6], [0x7ff, 0x7fff, 0x2, 0xb03, 0x1000, 0x5, 0x101, 0x3, 0x7, 0x7ff, 0x400, 0x4, 0xffff, 0x4, 0x7, 0x65b, 0x40, 0x3, 0x31, 0x0, 0x6, 0x7, 0x280, 0x2, 0x3f, 0x1, 0x9, 0x1, 0x8be3, 0x8, 0x1, 0x0, 0x6, 0x5, 0x8, 0x8, 0x0, 0x7, 0x101, 0x0, 0xc6c4, 0x200, 0x4, 0x3, 0x9, 0x5, 0x6a1, 0x4cee, 0x2, 0x100, 0x3, 0x7b, 0xffff, 0x7, 0x1, 0xfffffff8, 0x7ff, 0x769, 0x6cad3581, 0x8, 0x7, 0x1, 0x0, 0x6]}, 0x45c) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0], 0x1, 0x80800, 0x0, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6=r2}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x7ff}]}, 0x24}, 0x1, 0x0, 0x0, 0x2040001}, 0x4000084) 00:50:12 executing program 5: r0 = socket(0x26, 0x5, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x4) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bind$can_raw(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) 00:50:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x4) sendmsg$can_raw(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1d, r2}, 0x10, &(0x7f0000000180)={&(0x7f0000000100)=@can={{0x0, 0x0, 0x1, 0x1}, 0x6, 0x0, 0x0, 0x0, "b1d6359e14d56e76"}, 0x10}, 0x1, 0x0, 0x0, 0x200400c0}, 0x4040001) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r1, 0x7b0, &(0x7f0000000000)={@any, 0x2}) socketpair(0x21, 0x6, 0x1460a, &(0x7f0000000140)) [ 502.172019] binder: 2168:2170 ioctl c0306201 20000800 returned -14 00:50:12 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x30, 0x0, 0x1, 0x0, 0x4, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x30}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEV(r2, &(0x7f0000000480)={&(0x7f00000003c0), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, r4, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_DEVICE={0xc, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5}]}, @NL802154_ATTR_SEC_DEVICE={0xc, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xffff}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000001) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280)='802.15.4 MAC\x00', r1) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000001}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4084}, 0x640000c1) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140)='nl802154\x00', r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x20, r5, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x800) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="02002abd7000ffdbdf251f0000000c000600000000000000000003008000", @ANYRES32=0x0, @ANYBLOB="0c00060001000000010000000c0006000100000001000000"], 0x40}, 0x1, 0x0, 0x0, 0x40090}, 0x4010) r7 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm-monitor\x00', 0x2, 0x0) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000500)={0xffff, {0x2, 0x4, 0xa69, 0x4b87, 0x1, 0x1f}}) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x0, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:12 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x21240120}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)=ANY=[@ANYBLOB="34100000", @ANYRES16=r2, @ANYBLOB="fffbffffffffffff0000180000000c0006000000001e0000000008000300", @ANYRES32=0x0, @ANYRES64=r1], 0x34}}, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, r2, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, 0x0, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0x138b014859b057a7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r6, 0x56ad67db3d2dcc7c, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x40d1) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:12 executing program 5: socket(0x9, 0x80000, 0x6) 00:50:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 502.310900] binder: 2183:2187 ioctl c0306201 20000800 returned -14 00:50:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = fork() r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x200, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc0}, 0x8000) syz_open_procfs$namespace(r1, &(0x7f0000000240)='ns/cgroup\x00') r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000200)={&(0x7f00000001c0)=[0x7fff, 0x3, 0x2, 0x3, 0x80000001], 0x5}) 00:50:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000080)={0x6}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0xffffffff, 0x8, 0x6, 0x10000, 0x1, 0x7fff, 0x7], 0x7}) 00:50:12 executing program 5: socket(0x35, 0x2, 0x8000007) 00:50:12 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 502.426001] binder: 2199:2211 ioctl c0306201 20000800 returned -14 00:50:12 executing program 0: socketpair(0x2a, 0x5, 0x3, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$l2tp(r0, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xb4, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVICE={0x2c, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x40}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_SEC_DEVICE={0x20, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5}, @NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x2}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVICE={0x30, 0x23, 0x0, 0x1, [@NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x4}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5, 0x5, 0x1}, @NL802154_DEV_ATTR_PAN_ID={0x6, 0x2, 0xffff}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x8}, @NL802154_DEV_ATTR_EXTENDED_ADDR={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008005}, 0x800) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000240)=@hat={'changehat ', 0x1, 0x5e, ['(%\x00', '\xda(\x93$\xe0\x00', '&*&\xe0\x00', '\x00', '}\x00', '(.\x00']}, 0x31) 00:50:13 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000000)={{@host, 0x1000}, 0x0, 0x1, 0x5}) socket(0x26, 0x5, 0x0) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$can_raw(r1, &(0x7f0000000100)={&(0x7f0000000000), 0x10, &(0x7f00000000c0)={&(0x7f0000000040)=@canfd={{0x0, 0x0, 0x1, 0x1}, 0x1d, 0x0, 0x0, 0x0, "c5f8d448a7285762a20544dccba3a9f636b5f33c688b689eb04f5ece7dba978e4f17e04ad497fe9b4b28fb61e6e3c240d612ad6860cefb3d7ea983936fb0b014"}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004015) 00:50:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x3, 0x1, 0x705, 0x0, 0x0, {0x5, 0x0, 0x3}, [@CTA_LABELS={0x18, 0x16, 0x1, 0x0, [0x4, 0x885, 0x0, 0x678, 0xffffffff]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c890}, 0x4000) sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x5, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8014}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x0, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f0000000040)='syz1\x00') r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x4783, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000080)) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="ae3863d9c91704960fad2357920001f0c26b0b28b4e57c", @ANYRES64=0x0], 0x0, 0x0, 0x0}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4008803}, 0x0) [ 502.651491] binder: 2246:2249 ioctl c0306201 20000800 returned -14 00:50:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x28}, 0x1, 0x0, 0x0, 0x44000000}, 0x8018) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0xc010}, 0x0) sendmsg$can_raw(r2, &(0x7f0000000240)={&(0x7f0000000180), 0x10, &(0x7f0000000200)={&(0x7f00000001c0)=@can={{0x0, 0x0, 0x1, 0x1}, 0x4, 0x0, 0x0, 0x0, "a27d54597778ecf2"}, 0x10}, 0x1, 0x0, 0x0, 0x8001}, 0x40001) 00:50:13 executing program 5: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000)='802.15.4 MAC\x00', 0xffffffffffffffff) socket(0x26, 0x5, 0xffffffff) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x0, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) [ 502.702359] binder: 2256:2260 unknown command -647808850 [ 502.735263] binder: 2256:2260 ioctl c0306201 20000080 returned -22 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x0, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0xc, 0x0, 0x3}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000884}, 0x1) 00:50:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) sendmsg$IPSET_CMD_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100090}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0xa, 0x6, 0x301, 0x0, 0x0, {0x7, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000040}, 0x3000c880) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5c064400020003de438b000000000900010073797a30000000000c0006400000e6e27902753c087859a80000000000010c0006400050656e020000020900010073797a3100001e000c0006400000000067d4c7c9f8e11f6c5e19fd96bae03da14d473c0c7ffa88d12666ddd5c4196695c66224ad71654cf8458242b6f1bd6dd0e8283accef530a4596a987b0b15f05e94b206cc527b44f7c3929f1501868dc00adddf372d23a78c82a0b9ca74186eb3891b9b7f5ae143e97c84c4751586ee7b5ba7fb08d00a18d89019a2c64676c134eab07f83bb63bdcdae6105641e200000000000000000000002ec16830a6b48263432f739a8eece9d2caf9345fe20f8e84f96ff7739b11a4c20772123add30fb54c6bd9a442659d27c5aa7e6dbf4fcee241c55c87a14b4eaa7e73b5bce9ce032709856f7654bf4e926b89edc2a077625dfe99f316240cb2a9be76c4c0f18ac8021b240fa3c7568bbe23b27b2be8e0b74f3980b3ac030b6fc9aed33de6dd027585e7ed31537711ae9a14ce59d325fdb1c088bb110d94a2c6b0cd94555527d886383348d2d923473ed56677ce726fb3ba89eadc23ad4cbbabab88723018fcaa2c0b0f644c9286fbb853a2b24f012de491ceba3fd60ace6d9f4572a52dbe98bce67919a5bfab7f192c028c18f7c6ed87ceb3f29d4d4ba5e26e72133ddd510793f67813c2b155d3bd5"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendto$l2tp6(r1, &(0x7f0000000200)="216875faf88fa408b055a37dd2610f61f2bdf5628614", 0x16, 0x10, &(0x7f0000000240)={0xa, 0x0, 0x998e, @loopback, 0x9, 0x2}, 0x20) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:13 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=[@dead_binder_done], 0x0, 0x0, 0x0}) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r2, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x1}, @L2TP_ATTR_VLAN_ID={0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x48040}, 0x20000001) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x4000000) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x0, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 5: socket(0x1f, 0x5, 0x1000000) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x40, 0x440202) r1 = gettid() getpgid(r1) r2 = getpid() r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r2}, {0x0}, 0x37bf, 0x9}) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f0000000080)={0x401, 0x7, {r1}, {r4}, 0x4}) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000002080)={0x1ff, 0x1, {r1}, {r5}, 0xce}) 00:50:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x40801) 00:50:13 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x901) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x0, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 5: r0 = socket(0x26, 0x5, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x2, 0x3f, {0xffffffffffffffff}, {0xee01}, 0x2, 0x80}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x4, &(0x7f00000000c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@afid={'afid', 0x3d, 0xd637}}, {@dfltuid={'dfltuid', 0x3d, 0xee01}}, {@msize={'msize', 0x3d, 0x2}}, {@cache_fscache='cache=fscache'}, {@version_L='version=9p2000.L'}, {@nodevmap='nodevmap'}, {@cache_fscache='cache=fscache'}, {@version_9p2000='version=9p2000'}], [{@euid_eq={'euid', 0x3d, 0xee00}}, {@measure='measure'}, {@euid_eq={'euid', 0x3d, r1}}, {@obj_role={'obj_role', 0x3d, '#%-'}}, {@obj_type={'obj_type', 0x3d, '^!'}}, {@fsuuid={'fsuuid', 0x3d, {[0x32, 0x33, 0x61, 0x61, 0x513441d0527c5d2, 0x62, 0x35, 0x38], 0x2d, [0x63, 0x36, 0x65, 0x35], 0x2d, [0x30, 0xa, 0x34, 0x30], 0x2d, [0x39, 0x33, 0xd832be64ed0e7ed1, 0x36], 0x2d, [0x39, 0x34, 0x33, 0x65, 0x64, 0x61, 0x37, 0x66]}}}, {@measure='measure'}, {@euid_gt={'euid>', 0xee00}}]}}) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0xc048080}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x10000, 0x8, {0xffffffffffffffff}, {0xee01}, 0x3d8298bf, 0x8}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) sendmsg$nl_xfrm(r1, &(0x7f00000006c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000140)=@acquire={0x494, 0x17, 0x300, 0x70bd2c, 0x25dfdbff, {{@in=@private=0xa010100, 0x4d6, 0x32}, @in=@multicast1, {@in6=@dev={0xfe, 0x80, [], 0xc}, @in=@loopback, 0x4e20, 0x0, 0x4e20, 0x101, 0xa, 0x20, 0x20, 0x87, 0x0, 0xee01}, {{@in6=@private2={0xfc, 0x2, [], 0x1}, @in=@rand_addr=0x64010102, 0x4e24, 0x1ff, 0x4e23, 0x0, 0x2, 0x20, 0x0, 0x6c, 0x0, r2}, {0x5, 0x3ff, 0x101, 0x0, 0x4, 0x6, 0x4, 0x9}, {0xa, 0xffffffffffffffff, 0x9, 0xfffffffffffffff8}, 0x6, 0x6e6bbf, 0x2, 0x0, 0x6, 0x3}, 0x80, 0x1, 0x3, 0x70bd2b}, [@algo_comp={0x98, 0x3, {{'deflate\x00'}, 0x280, "7a016cabc4099a3b18e738e06238d9d5756ceb8cb1d3331d316f52bd78662e5a6df4c65ed821cacde7955ecf96ea034800f3761e52211802cf5fc49884ddfe55e07bbfe93f91e8467a7ed9db3759a40f"}}, @sa={0xe4, 0x6, {{@in=@multicast2, @in6=@private2={0xfc, 0x2, [], 0x1}, 0x4e23, 0x4, 0x4e23, 0x0, 0x2, 0xa0, 0x20, 0x87, r3, 0xee01}, {@in=@loopback, 0x4d3, 0x2b}, @in6=@loopback, {0x9, 0x1, 0xffffffff, 0x9, 0x5, 0x2325, 0x0, 0x2}, {0x1, 0x9, 0x9, 0x5}, {0xff, 0xffffffff, 0xa0}, 0x70bd29, 0x3503, 0x2, 0x0, 0x80, 0x85}}, @sec_ctx={0xe8, 0x8, {0xe4, 0x8, 0x1, 0x1, 0xdc, "a3abb489c08fb73075738bfe81ec4fadb1ae2f32dbfa59f49d7e59ee2624f680a23f3c59946d1c9d425d4de1060a19c983d41f2ce82d0f81b4ac228606b1d62c22ae1ff648fcc042b7aa4cddaac0f1a3d18f490f2451ed3e43671f642e86966bf4c03744a0bfd4f332acaa11b4d48d2341a30f38a2b03e8bd7f5765df234c67b4dd982a6beeeb4d1312de5cf04f9de4cf40366637d577e06d7d11d9ea10d9a5de783b79eed0ebc0b72c2177f9cde1b8959cde5eaaa7db04d4f2077e4f2763cc8668c0676d7dc3d2489bdbd64e6d3d13fdea6a2dfd8bb48ca6f41a3a5"}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x2}, @algo_aead={0xfe, 0x12, {{'seqiv(morus1280)\x00'}, 0x590, 0xa0, "5a7f32e9667498c8c4fe09bdf6f3b1c6a1e45fd0da7f1e9f7c852e22639d98daf8cf832d86ac2d2ea0ba3b239e9f9f06f10ac3a3612105d48eeef95a5bd1e9001ade57239274d0557618d3b9cd93bcedfca0058f7ea6a575b00e19164c648af8f6f095b4541792ab4500aa3f54c91213bcd35fa9d4bcd6ca3c98489a2317c627543a3ab51e7cf62d9841a252510fa0539041cfbf8415b23ee84426acb2991df1ba4606a0d48acda632728e1dc856c289643e"}}]}, 0x494}, 0x1, 0x0, 0x0, 0x4040084}, 0x40000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:13 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x7c, 0x13, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x0, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x40000c4}, 0x4000000) 00:50:13 executing program 5: socket(0x2a, 0x1, 0x8) r0 = socket(0x27, 0x1, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x10041, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$pppl2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x3, 0x4, 0x4, 0x2, {0xa, 0x4e23, 0x2, @private0, 0x9}}}, 0x3a) r3 = socket$can_raw(0x1d, 0x3, 0x1) recvfrom$l2tp(r0, &(0x7f0000000000)=""/46, 0x2e, 0x121, 0x0, 0x0) fcntl$getown(r3, 0x9) 00:50:13 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="35db005b", @ANYRES16=r1, @ANYBLOB="000228bd700000dbdf250800000008001f00a613a71781395df843cb74232f917d6e37ee0bab2ce9eee3854354cb18ae2c464b4f7201b3202f8481bddecd", @ANYRES32=r2, @ANYBLOB="08000b000200000006001c0006000000060003003f000000"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0xc4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0)='l2tp\x00', r0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x5c, r4, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40041}, 0x10) recvfrom$l2tp(r2, &(0x7f0000000300)=""/103, 0x67, 0x140, &(0x7f0000000380)={0x2, 0x0, @multicast2}, 0x10) 00:50:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r1, &(0x7f0000000000)=""/167, 0xa7, 0x40000000, 0x0, 0x0) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x7}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000090}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vmci\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r2, 0x7b1, &(0x7f0000000140)={&(0x7f0000000680)=[0x0, 0x1, 0x5ad, 0x3, 0x6, 0xfffffffc, 0x10001, 0x6, 0x5, 0x9, 0x0, 0x9281, 0x2, 0x100, 0xffff, 0x5, 0x7ff, 0x2, 0x4, 0xca, 0x1, 0x4, 0x200, 0x5, 0x8, 0x4, 0x3, 0x0, 0x5, 0x400, 0xffffffff, 0x5, 0x1ff, 0x78ba, 0x200, 0xa65, 0x8001, 0x9, 0xffff, 0x4b8d, 0x3, 0x3, 0x20000, 0x80000001, 0xfe8c, 0x800, 0x1f, 0x3ff, 0x6, 0x8, 0x7, 0xfff, 0xbb3b, 0x1, 0x779, 0x4, 0x0, 0x8, 0x2, 0x2, 0x0, 0x7fffffff, 0xfffffff8, 0x7f85c2ba, 0x3, 0x4, 0x7fffffff, 0x1ff, 0x57e337f8, 0x83, 0x7, 0x80000000, 0x1000, 0x7, 0x4, 0x3, 0x9, 0x0, 0x9, 0x7f, 0x10001, 0x8, 0x1f, 0x10001, 0xd6ed, 0x7fff, 0x4, 0x1000, 0x2, 0x3, 0x0, 0x0, 0x8, 0x80000000, 0x8447, 0x6, 0x0, 0xffffffff, 0xff, 0x9, 0x1, 0x800, 0x8, 0x1, 0x400, 0x200, 0x38000000, 0x4, 0x80, 0x6, 0x8, 0x1, 0x7, 0x3, 0x0, 0x2, 0x3, 0xfff, 0x144, 0x4, 0xe2d, 0x1e, 0x10000, 0x399c, 0x5, 0xec0, 0x0, 0x7, 0x9, 0xb00, 0x7f, 0x9, 0x9, 0xff, 0x7f, 0x4, 0xffff, 0x653d4acb, 0x58, 0x4, 0xdba6, 0xaf1, 0x1000, 0x2, 0xda0d, 0x8, 0xff, 0xffff, 0x1, 0x74, 0x7fffffff, 0x6, 0x6, 0x0, 0x4, 0xd0c, 0x8, 0x3ff, 0x20, 0x1, 0xfb0, 0x0, 0x9, 0x5, 0x86, 0x3, 0x1000, 0x29, 0x6d3e, 0x1246, 0x3, 0x0, 0x7, 0x5, 0x4, 0x6, 0x3, 0x4, 0x0, 0xffffffff, 0x0, 0x4, 0x400, 0xfffffbff, 0x4, 0x9, 0x3f000000, 0x8, 0x9, 0x8, 0x80000000, 0xfe1, 0x0, 0x5, 0x7f, 0x50000, 0x80, 0xfffffff9, 0x3d03, 0x91, 0x9, 0x3, 0x9, 0xcffa, 0x3, 0x3, 0xb7, 0x4, 0x2, 0x93, 0x101, 0xfff, 0x7, 0x93, 0x3, 0x371f, 0x1f, 0x4, 0xffffffe0, 0x3f, 0x200, 0x2, 0x3, 0x6, 0xffffb8e9, 0x2, 0x1, 0x81, 0x3, 0x8, 0x4596, 0x1, 0x0, 0x1, 0x101, 0x7639, 0x5b8, 0xff, 0x2, 0x2, 0x2b0, 0xffffffff, 0x7f, 0x8, 0x1, 0x0, 0x8, 0x81, 0xb8, 0x9, 0x40100, 0x2, 0x3ff, 0x6, 0x8f46, 0x1000, 0x775, 0x10001, 0x1, 0x54, 0x1c0, 0x693c, 0x80000001, 0x2, 0x3, 0xfffffffb, 0x7f, 0x800, 0x80000000, 0x3363, 0x9, 0x0, 0xfffffffd, 0x10001, 0x101, 0x80, 0x9, 0x7, 0x1, 0x7, 0x3f, 0x7, 0x8001, 0xfa, 0x10001, 0x3, 0x2, 0x8, 0x8, 0x0, 0xffffffa2, 0x1, 0x400, 0x5, 0x0, 0x9, 0x21e, 0x17, 0x4, 0x0, 0xe1a5, 0x4562f264, 0x2, 0x15, 0x80000001, 0x6, 0x4, 0x0, 0x6, 0x3ff, 0x40, 0x8, 0x6, 0x4, 0xd59d, 0x8, 0xffffff5e, 0x3, 0x400000, 0x5, 0xad4, 0x7, 0x1, 0x40, 0x71ab, 0x9b0, 0x2e9, 0x6975ce51, 0xffffffff, 0x2, 0x2, 0x800, 0x8, 0x1000, 0x7f, 0x0, 0x5, 0xb8, 0x800, 0x6, 0x3, 0xc6, 0x4, 0x6a, 0x8, 0x7, 0x0, 0xff, 0x101, 0x2, 0xc29, 0x1870b462, 0x0, 0x0, 0x101, 0x5c8a, 0x3f, 0x6, 0x8001, 0x5, 0x6, 0xff, 0xe26, 0x10001, 0x1, 0x8c5e, 0x8000, 0x8000, 0x7fff, 0x4, 0x9b7, 0x1000, 0x4, 0x2, 0xc0000, 0x0, 0x6, 0x101, 0x2, 0x9, 0x3, 0xff, 0x7, 0x8, 0xffffffff, 0x71, 0x1, 0x4, 0x9c47, 0xe, 0x9, 0x7b, 0x80, 0x4, 0x6, 0x2, 0x8000, 0xea, 0x3, 0x80000000, 0x65c21c09, 0x5, 0x6, 0x2, 0xffff, 0x40000, 0x0, 0x3ff, 0x40, 0x0, 0x1, 0x80, 0xca, 0x4, 0x14ba, 0x1000, 0xb4, 0x7, 0x4, 0x0, 0x5, 0x81, 0x0, 0x4, 0x0, 0x13, 0xe02, 0x9, 0x3, 0x1, 0x0, 0x2, 0x401, 0x9, 0x2, 0x5, 0x101, 0x5, 0x3, 0x1, 0x4, 0x1, 0x80000000, 0x0, 0x200, 0x32a3, 0x9, 0x4, 0x0, 0x3, 0xfffffc8e, 0x4, 0x7, 0x3, 0x9, 0x3, 0xfffff935, 0x7, 0x101, 0xc978, 0x8, 0xfffffffb, 0x0, 0x3, 0x7ff, 0x0, 0x7, 0x40, 0x6, 0x4, 0x0, 0x7d1, 0x4, 0x7, 0x10001, 0x80000, 0x40, 0x6, 0x8000, 0x80000000, 0x7f, 0x7f, 0x6419, 0xf258, 0x3, 0xc, 0x93f1, 0x6, 0xfffffff7, 0x1, 0x4, 0x1, 0x10001, 0xfffffff8, 0x15f, 0x8, 0xb1, 0x7, 0x0, 0xfff, 0x7, 0x4b78, 0xffff, 0xa5ff, 0xe9d, 0x9, 0xd17f, 0x8, 0x400, 0xffff, 0x4, 0x20, 0x15b79399, 0x5, 0x9, 0x3, 0xffffffff, 0x1, 0x1e, 0x540, 0x4, 0xffff57e7, 0x8, 0x9, 0x10001, 0xfffffffb, 0x10000, 0x7, 0x7ff, 0x8001, 0x9, 0x9, 0x5080, 0x400, 0x0, 0x4, 0x10e96a75, 0x7fffffff, 0xfffffffc, 0x20000, 0x1000, 0x358f3d04, 0x8, 0xfffffffc, 0x100, 0x5, 0x3, 0xf3, 0x81, 0x4, 0x6, 0x0, 0x0, 0x4, 0x800, 0x6, 0x8, 0x3, 0x101, 0xb4f, 0x7, 0x6, 0xc4b9, 0xfffffe01, 0x7fff, 0xffffffff, 0xf51, 0xffff4699, 0x9, 0x693, 0x4c0, 0x4, 0x9, 0xffffffff, 0x2, 0x2e7b, 0x5, 0x3ff, 0x65c0c08b, 0x2300, 0x20, 0x10001, 0x0, 0x3ffc0000, 0x6, 0x5, 0x4, 0x1, 0x3, 0x7, 0x8, 0x6, 0x8, 0x5, 0x2, 0x2edf, 0x1, 0x6f9b, 0x4, 0x9, 0xfffff001, 0x40, 0xf08, 0x8001, 0x3, 0x7, 0x17, 0x8, 0x3, 0x1, 0x1f, 0x1, 0x1, 0x7, 0xff, 0x1, 0x3, 0x3, 0x1, 0xfffffffc, 0x7f, 0x0, 0x8, 0xf418, 0x4ff7, 0x1, 0x200, 0xcc, 0x5094, 0x7, 0x44, 0x80, 0x7, 0x10001, 0x40, 0xfffffffa, 0xc517, 0x5, 0xae3, 0xad1, 0x20, 0x800, 0x172e, 0x0, 0x0, 0x4, 0x7, 0x5, 0x7, 0x2, 0x32ff, 0x5, 0xffffffff, 0x0, 0x80, 0x8, 0x5, 0x3, 0x6, 0xff, 0xffff, 0x100, 0x4, 0x200, 0x9, 0x40, 0x0, 0x7, 0x4, 0x3, 0x0, 0x401, 0x70000000, 0x4, 0x9, 0x10001, 0x4, 0xfe0e, 0x401, 0x7, 0x5, 0x9, 0x0, 0x8f0f, 0x80000000, 0x1000, 0x80, 0x81, 0x800, 0x8, 0x3, 0xfffff800, 0x8001, 0xfffffc00, 0x1, 0x1, 0x4, 0x3, 0x7f, 0x1, 0x6, 0x3, 0x80000000, 0x1, 0x1, 0x7, 0x81, 0x6, 0x2c07, 0x3ff, 0x8, 0x3, 0x5, 0xfffff6b5, 0x1, 0x7, 0x80000000, 0x6, 0xfffffffc, 0x2, 0x2, 0x800, 0x7ff, 0x10001, 0x9, 0x3, 0x9, 0x5, 0x80000001, 0x7, 0x4, 0x3, 0x6, 0x20, 0x101, 0x7fff, 0x0, 0x101, 0x0, 0x9, 0x8830, 0x620, 0xffffff1a, 0xffffffff, 0x2, 0x9, 0x8001, 0x2, 0x6, 0x0, 0x7, 0x14, 0x0, 0x8, 0xfffffff7, 0x62a7, 0xdbd, 0x6, 0xfff, 0x8, 0x1, 0x6, 0x594, 0x4, 0x5, 0xcb, 0x0, 0x3, 0xf2f, 0xb70, 0x7fff, 0x400, 0xffffffe0, 0x5, 0x6, 0x3, 0x6, 0x81, 0x10000, 0x4, 0xfffffff8, 0x81, 0x24, 0x800, 0xffffffff, 0x958, 0x6, 0x25, 0x7, 0x0, 0x0, 0x0, 0x6, 0xb29, 0xc0000000, 0x3, 0x3, 0x6, 0x101, 0x0, 0xc081, 0x2e36b09c, 0x9, 0x3, 0x2, 0x0, 0x8, 0x4, 0x0, 0x4, 0xfffffff1, 0x48000, 0xf62, 0x8, 0x1eb, 0xc0, 0x7, 0x0, 0x10001, 0x4, 0xf4df, 0x10000, 0x8, 0x10, 0xffffffd3, 0x7, 0x400, 0x7, 0x8001, 0x5cb00, 0x100, 0xfffffffe, 0x80000001, 0xc009, 0xfffffff8, 0xffff0000, 0x7ff, 0x4, 0x6, 0x40, 0x5, 0x5, 0x6, 0x2, 0x80000000, 0x1, 0x300000, 0x10001, 0x8, 0x3, 0xf7b8, 0x4, 0x401, 0x5, 0xff, 0x7d, 0x2, 0x200, 0x9, 0x2, 0x7fff, 0x2, 0x9, 0x7fff, 0x9ad0, 0x204e, 0x8, 0x8, 0x516, 0x3, 0xffffffe1, 0x98a, 0x5, 0x8, 0x5, 0x100, 0x4a3, 0x6, 0x800, 0x8, 0x40, 0x8, 0x6, 0x3, 0x0, 0x8, 0x1, 0x20, 0x2, 0xc0de, 0x9, 0xfffff800, 0xff, 0x7, 0x1, 0xfffffff8, 0x40000, 0x401, 0x9, 0x3, 0x4, 0x6, 0x8, 0x6, 0x81, 0x60000, 0x80000000, 0x4, 0x8, 0x7fff, 0x4, 0xf3, 0x2, 0x5, 0x5, 0x9, 0x7, 0x7, 0x7, 0x9, 0x3, 0x1, 0x39dd, 0x8, 0x3, 0x7, 0x1, 0x3, 0x4, 0x7fffffff, 0x8, 0x7, 0x80, 0x400, 0x34b, 0xab0, 0x6, 0x6, 0x2, 0x7fff, 0x1ff, 0x7ff, 0x5, 0x80000000, 0xffff0000, 0xffffffe1, 0x200, 0x1, 0x831, 0x4, 0x2, 0x7, 0xffffffff, 0x3, 0x1f, 0x3, 0x10001, 0x8000, 0xc9b6, 0x4, 0x0, 0x0, 0x1000, 0x1, 0x3ddd, 0x101, 0x2, 0xff, 0x7ff, 0x6e8, 0x1000, 0x401, 0xfffffcf6, 0x7f, 0x0, 0x6, 0x5, 0x8, 0xffff, 0x401, 0x100, 0xb4, 0x801e, 0x1, 0x2, 0x9, 0x6a, 0x1, 0xa33d, 0x7, 0x4, 0x4, 0x1, 0x7fffffff, 0x7, 0xffffffc1, 0x1, 0x9, 0x6, 0x1, 0x7, 0x7, 0x3, 0x6505, 0x751e, 0xf935, 0x7, 0x7, 0x7, 0x2fb9, 0xc0c5, 0x4, 0x6, 0x1, 0xfffffffe, 0x0, 0x10001, 0x8, 0x3, 0x7, 0xffff, 0x0, 0xf4, 0x80], 0x0, 0x400, 0xc, 0x4}) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:13 executing program 5: r0 = socket(0x10, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x3, 0x0, 0x7ff, 0x1a, 0x3, 0xcc2c, 0x40, 0xff, 0x7fffffff], 0x9, 0x80800, 0x0, 0xffffffffffffffff}) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="6e299387", @ANYRES16=0x0, @ANYBLOB="00042500000000000000000000000000180000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x2001}, 0x8081) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r1, 0x7aa, &(0x7f0000000080)={{@hyper, 0x6}, 0x7a5, 0xfffffd07}) socket(0x5, 0x5, 0x2) 00:50:13 executing program 3: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendto$l2tp(0xffffffffffffffff, &(0x7f00000000c0)="5f8b0f000b4619f04d75290963fc45bef35f7d9367c88bf26624d31751eb4fdbe293384e66e8ddc750630e03c1a25f0966ded8608464a0c788952a7891f2a094406bf4a282ed821a6bdb02c92af1070793cd241fd704eb8bf48cc6c49e0f2fd9ad58f907508b632b13ef7c7fe7b3d680dbb48c7892cd3568d7b1312f13e7a1cdc8c70c7f0b288baf882acb1c7ffe2eb4f23367c0", 0x94, 0x4005, &(0x7f0000000180)={0x2, 0x0, @rand_addr=0x64010100, 0x4}, 0x10) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x3ff, @mcast1, 0x18000000, 0x1}, 0x20) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/uts\x00') ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000080)={0x9, {0xffff, 0x3ff, 0x6, 0xfffffff8, 0xef, 0x4}}) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) 00:50:13 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:13 executing program 3: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:13 executing program 5: socket(0x9, 0x2, 0x9) 00:50:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x6, 0x2, 0x7, 0x7, 0x10001], 0x5, 0x80800, 0x0, 0xffffffffffffffff}) getsockname$l2tp(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x6c, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x0, 0x2, 0x2b}, @flat=@weak_handle={0x77682a85, 0x0, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000680)=""/4096, 0x1000, 0x2}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}, 0x40}, @acquire_done, @free_buffer], 0xc0, 0x0, &(0x7f0000000240)="00c0d68e20c7b71f087bb97292f3f68686c9c807d46ff6a500344136c52e1de113c3e73066557a9ab69e3beb7e09f5bb93a8d25603045257b0b0f30ecfd2e5e85c46d64704f3cd82aed4faee6278b49a69f629304413da7b0a3e4a229cdc2e83a6aff8d490e8d64fefbe996cad37df44034c87dc5a04e23def7bd9ed22a0568d3bf8fe58dbcad512b5946052bde99bc1a0e8b4cb64886ead4088bade5f559c43f1f56306bb9c9de4749ad4d86ed24012a0ea82a1751aceb145213611e038638b"}) 00:50:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00', 0xffffffffffffffff) 00:50:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x545f76d34bdf7b78}, 0xc, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="680200001b0004002dbd7000ffdbdf25fe8000000000000000000000000000bb0a0101020000000000000000000000004e2000374e2100010200b0002a000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="01040000000000000500000000000000a2000000000000007f000000000000000100000000000000000800000000000001000000000000000700000000000000ab00000000000000ffff0000000000000600000000000000000400000000000001000080b76b6e000001020100000000ff0000000000000084000500ac1414aa000000000000000000000000000004d23200000002000000ffffffff000000000000000000000000073500000102050081000000000000000010000020010000000000000000000000000002000004d6320000000a000000fe880000000000000000000000000001013500000300210003000000050000000000000028001a0000000000000000000000000000000001000000000000000000000000000000010200e8030800180000ffffffe400060064010101000000000000000000000000fc010000000000000000000000000001010000004e2200050200804004000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="20010000000000000000000000000001000004d632000000640101020000000000000000000000000300000000000000040000000000000090000000000000001f0000000000000001000000000000007f000000000000001508000000000000070000000000000003000000000000000800000000000000010000000000000000000000000000000900000001000080040000002dbd7000043500000a000407200000000000000008001f00", @ANYRES32=0x0, @ANYBLOB="0a000b0500004000000000e4702bb3"], 0x268}, 0x1, 0x0, 0x0, 0x8}, 0x4) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000008c0)=@flushpolicy={0x2a0, 0x1d, 0x300, 0x70bd25, 0x25dfdbff, "", [@XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x3f}, @mark={0xc, 0x15, {0x35075d, 0x45}}, @algo_auth_trunc={0x135, 0x14, {{'sha3-384\x00'}, 0x748, 0xc0, "d16ff2d020376526e3613fc61edba8e6069b54a061cd5f053df535ccafee8937ba7d56b0e8b1a2555be4aa4b2332a01ed7ac3c0325e15904b18f4ca92617cc1bca57ff956baf6a4d0dcf7fbe67b35c3f6da3b330ca450a35d8ef450842f2ac5a7839d8cb2ff7ec0a0c4023712b70ce907d9cf8bea7d189f8e13bc4746bf2108941a87464c31cbd6410694402fe785808c9775a9f0ea4fa579ad4cffe7be6ce5dcf312d61e1fcd91c006a722c303671c8c96ece4174561873672cdf481215b995e8f843731d265ffef83437359326ba8503c38726b5407f766befdbeed33ebf4a265b4d4d777fa803c4"}}, @tmpl={0x144, 0x5, [{{@in=@local, 0x4d3, 0x32}, 0xa, @in6=@empty, 0x3507, 0x3, 0x3, 0xfc, 0x7, 0x0, 0x1}, {{@in6=@private2, 0x4d3, 0x33}, 0xa, @in=@broadcast, 0x3503, 0x3, 0x1, 0x8, 0x7f, 0x80000000, 0x3f}, {{@in6=@private0={0xfc, 0x0, [], 0x1}, 0x4d6, 0xff}, 0xa, @in6=@private0={0xfc, 0x0, [], 0x1}, 0x34ff, 0x3, 0x2, 0x81, 0x3ff, 0x2, 0x3}, {{@in6=@dev={0xfe, 0x80, [], 0x19}, 0x4d4, 0x32}, 0x2, @in=@private=0xa010102, 0x3502, 0x3, 0x2, 0x1, 0x3, 0x68, 0x7}, {{@in=@multicast1, 0x4d6, 0x2b}, 0xa, @in6=@private0={0xfc, 0x0, [], 0x1}, 0x3506, 0x4, 0x2, 0xf7, 0xfffffff7, 0xee96, 0x2}]}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x4000050}, 0x890) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @rand_addr=0x64010101}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x81}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x60}, 0x1, 0x0, 0x0, 0x8890}, 0x4000080) socketpair(0x28, 0x2, 0x5265, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:14 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1}, @flat=@binder={0x73622a85, 0x100, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x60000881) 00:50:14 executing program 3: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) 00:50:14 executing program 5: socket(0x26, 0x5, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40, 0x0) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000001040)={&(0x7f0000000040)=[0x6, 0x1, 0x5, 0x0, 0x7f, 0x5, 0x3f, 0x4, 0x97fd, 0x3, 0x5, 0x7fffffff, 0x5, 0x40, 0x0, 0x1f, 0x40, 0x101, 0x1, 0x7, 0x6, 0x0, 0x1, 0x7ff, 0x0, 0x4, 0x0, 0x7de1, 0x7ff, 0x44a0, 0x8, 0x6, 0xe73, 0x1, 0x5, 0x80000000, 0x800, 0x268, 0x2d5d, 0x6, 0x4, 0x0, 0x3, 0x7, 0x86, 0x1e28, 0x5bef, 0x3, 0x4, 0x2, 0x11b3, 0xa49, 0x200, 0xe993, 0x0, 0x8, 0x2131, 0x2, 0x17, 0x7, 0x1, 0x4, 0x2, 0xffff605e, 0x3, 0x9, 0x8001, 0x2, 0x9, 0x88, 0x1000, 0x3, 0x81, 0x5, 0x4, 0x9, 0x6, 0x7f, 0x401, 0xa51f, 0x800, 0x401, 0x7f, 0x8, 0x7fff, 0xd1, 0x4, 0x86, 0x0, 0x9, 0x96, 0x1f79, 0x1, 0x1000, 0x81, 0x1, 0x1, 0x9, 0x1, 0x2, 0xe6581351, 0x8, 0x3d7, 0x1000, 0xffffffc0, 0xfffff8b4, 0x7fff, 0x67, 0x0, 0x9, 0x3, 0x8, 0x3, 0x4, 0x3, 0x20, 0x9, 0x9, 0x984, 0x5, 0x8, 0x400, 0x1, 0xed5, 0x10000, 0x535d, 0xfff, 0x4, 0x9, 0x2fc, 0x400, 0xa0000000, 0xfffffffd, 0x7, 0x2, 0x7fffffff, 0x2, 0x4, 0x7ff, 0xffffffff, 0xffffffff, 0xffff, 0x96f, 0x0, 0x5030, 0x1, 0x400, 0x3, 0xff8, 0x5, 0x5, 0x80000000, 0x9, 0x6, 0xfff, 0x7, 0xbd2e, 0x9, 0xb3, 0x7, 0x6, 0x5, 0x3bd, 0x4, 0x3, 0x101, 0x800, 0x3942, 0x1, 0x6, 0x4, 0x1, 0x7, 0x898d, 0xa, 0x1a, 0xffffffff, 0x0, 0x2, 0x800, 0x4, 0x9, 0x200, 0x3548, 0x0, 0x3, 0x1, 0x48000, 0xff, 0x1, 0x9cc, 0x0, 0x8, 0x3875, 0x0, 0x800, 0x0, 0x5, 0x2, 0x460000, 0xffff, 0x2, 0x1, 0x2, 0x7f, 0x6, 0x7fffffff, 0x101, 0x5, 0x3, 0xebd, 0x2, 0x8ae, 0x1, 0x0, 0x0, 0x7, 0xfac, 0x5, 0x3, 0x200, 0x8, 0x3ff, 0x5c, 0x8, 0x3, 0x6, 0x7f, 0x3ff, 0x3f, 0xf445, 0x3f, 0x2, 0x10000, 0x3, 0x579d, 0xffff, 0x4181ca1f, 0x7fffffff, 0x2f, 0x6, 0x101, 0x7f, 0x8, 0x10000, 0x5, 0x1, 0x40, 0x9, 0x1, 0x8, 0x22c4, 0x4, 0x10001, 0xda11, 0x401, 0x7, 0x7, 0x20, 0x3, 0x6, 0x5, 0xb1, 0xda9, 0xe47d, 0xf2f8b486, 0x9, 0x7f, 0x1, 0x4, 0x9, 0x3cd, 0x8, 0x8, 0xad9b, 0x9d16, 0xffffffff, 0x8, 0x3, 0x52, 0x7, 0x81, 0x0, 0x2, 0x6, 0x9, 0x5, 0x100, 0x3f, 0x80, 0x1ff0, 0x20, 0x3d52, 0x64, 0x1, 0x4, 0x8, 0x3ba, 0x21b, 0x3, 0x68df863a, 0xfffffff9, 0x7, 0x2, 0x80000000, 0x3, 0x1, 0xfffffffc, 0x10000, 0x0, 0x9, 0x100, 0x5, 0x5b, 0x9, 0x5, 0x2, 0x2, 0xfffff000, 0xffffffb7, 0x9, 0x0, 0x0, 0xfffffffb, 0x6, 0x1, 0x5, 0x2, 0x8001, 0x10000, 0x5, 0x7, 0x4, 0x121c71c9, 0x0, 0x1, 0xad, 0x10000, 0xd5d5, 0x8001, 0x5, 0x6, 0x6, 0x3, 0x401, 0xfff, 0x1000, 0x9, 0x1, 0x3f, 0x4, 0x1cc055b, 0x6, 0x80, 0x7ae, 0x2, 0x101, 0x101, 0x9, 0x1, 0xfff, 0xfff, 0x211, 0x1, 0x100, 0x358, 0x3, 0x5, 0xbe52, 0x8, 0x838, 0x0, 0x335, 0x4, 0x80000000, 0x1, 0x7, 0x4, 0x57, 0x40, 0x7, 0x1ff, 0x9, 0x0, 0x1, 0x8, 0xeed, 0x4, 0x80000001, 0x8, 0x3b, 0xdb04, 0x1, 0x0, 0x7fff, 0x6, 0x7, 0xe701, 0x7, 0x84, 0x6, 0x5, 0x9, 0x948, 0x10000, 0x1, 0x1, 0x1, 0x101, 0x8000, 0x2, 0x1000, 0x2, 0x2, 0xffff, 0x3ff, 0x7, 0x212, 0x3, 0x0, 0x0, 0x7, 0x5ef0, 0x5, 0x3, 0x9, 0x9, 0x5, 0x0, 0x7ff, 0x7, 0x46c, 0xffff6024, 0x8, 0x8, 0x6, 0x4, 0xff, 0x10000, 0x40, 0x9, 0x9, 0x8000, 0x64c, 0x4, 0x1000, 0x2, 0x1000, 0x67, 0x0, 0x8, 0x7, 0xaa, 0x6, 0x8001, 0x7, 0xfffffff8, 0x80000001, 0x7fff, 0x5, 0x401, 0x0, 0x2, 0x9fff, 0x3ff, 0xf35d, 0x2, 0x80000000, 0x2, 0x7f, 0x288a, 0x10000, 0x80000000, 0x7f, 0x5, 0x6adf, 0x5, 0x5, 0x7, 0xfffffff7, 0x7, 0x1f, 0x5, 0x55, 0x0, 0x9, 0x2, 0x7a0, 0x5, 0xffff, 0x47df, 0x1, 0x7, 0x8, 0x7, 0x3, 0x1, 0x35300, 0x80, 0x8, 0xffffffff, 0x10001, 0x80, 0xd5, 0x80000001, 0x5, 0x4, 0x6, 0x6500, 0x401, 0x0, 0x7fffffff, 0x1, 0x1ff, 0x7, 0x9, 0x8000, 0x7, 0x8, 0x1ff, 0x20, 0x5, 0x2, 0x1, 0x0, 0x3, 0x6ce, 0x3, 0x0, 0x0, 0x80, 0xdf, 0xee1, 0x0, 0x3, 0x400, 0x7, 0x3, 0xd86, 0x20, 0x2, 0xff, 0xe9, 0x7, 0x6, 0x10001, 0x1, 0x8, 0xb3b6, 0x4, 0x10000, 0x2, 0xa3f, 0x80, 0x0, 0x9, 0xff, 0x1, 0x9, 0x3f, 0xffff56af, 0xac9, 0xfffffffa, 0x1f, 0x8, 0x81, 0xc60f, 0x2e, 0x3, 0x1, 0x101, 0x3f, 0x1, 0x5, 0x8, 0x6, 0x80000000, 0x20, 0x81, 0x0, 0x1, 0x7fff, 0x7f, 0x3, 0x4, 0x200, 0x7, 0x0, 0x7, 0x0, 0x20000000, 0xfffffffe, 0x4, 0x10000, 0x5205, 0x2, 0xe2b0, 0x1, 0x5, 0x2, 0x7, 0x2, 0x4, 0x5, 0xe4, 0x4, 0x8, 0x80000001, 0xfff, 0x4, 0x1dc88000, 0x0, 0xc7c, 0x1000, 0x81, 0x0, 0x421, 0x3, 0x6, 0xb4, 0x5cc, 0x5, 0xde5, 0x5, 0x3, 0x8, 0x7, 0x1f, 0x2, 0x20, 0xfff, 0x7fffffff, 0x9, 0x5, 0x7, 0x3, 0xffff, 0x1, 0x4, 0x3ff, 0xfffffffd, 0xc5, 0x9, 0x3, 0x7, 0x0, 0x7fff, 0x6, 0x5, 0x7, 0x9, 0x1, 0x6, 0xc97b, 0x8, 0x6, 0x9, 0x6, 0x1, 0x9, 0xfffff800, 0xff, 0x3ff, 0x81, 0x8, 0x8000, 0x9, 0xfffeffff, 0x9, 0x7fff, 0xffffff58, 0x1, 0x1ff, 0xa1d6, 0x8, 0x0, 0x10000, 0x800, 0x80, 0x101, 0x401, 0x0, 0x1, 0xfffffffe, 0x7f, 0x6, 0x80000001, 0x517, 0xb5b, 0x1, 0x1, 0xb7b, 0x1, 0x23, 0xfffffff7, 0x0, 0x4, 0x1, 0x0, 0x3, 0x0, 0x10000, 0x4, 0x265, 0xfee6, 0x3, 0x4, 0x9, 0x7fffffff, 0x5, 0x4, 0x80000000, 0x10000, 0x52, 0x8, 0x12, 0x4d9, 0x82d0, 0x6, 0x98, 0x40, 0x1, 0x81, 0x9, 0x101, 0x4, 0x6e, 0xfffffe00, 0x800, 0xff, 0x800, 0x80000000, 0x4, 0x2, 0x6, 0x1, 0x5, 0x1, 0x9, 0x7, 0x4, 0x800, 0x7, 0x0, 0x3, 0x7fffffff, 0x0, 0x2, 0x0, 0x800, 0x6d, 0xfffffffe, 0x5, 0x100, 0x10000, 0x5, 0x8000, 0x9, 0x6e0, 0x3ff, 0x1, 0x6, 0xfffffff8, 0x6, 0x7ff, 0x10000, 0x5, 0x7c9, 0xffff, 0x3, 0x100, 0x0, 0x760d, 0x2, 0xfffffe01, 0x3, 0xfff, 0x7, 0x5, 0xfff, 0x6, 0xfff, 0xc84, 0x9, 0xecd, 0x7fffffff, 0x9, 0x8, 0xaed, 0x3f, 0x7f, 0x0, 0xffffcf21, 0x1000, 0x0, 0x0, 0x7, 0x5, 0x6, 0x3a3, 0x7fffffff, 0xfffffffe, 0x7f, 0x100, 0x7ff, 0x101, 0x10001, 0x5b, 0xffffff00, 0x100, 0x9, 0x2, 0x0, 0x4, 0x6, 0x5, 0x10001, 0x1, 0x4, 0x800, 0x0, 0x3e0, 0x7f, 0x9, 0x0, 0x7ecb, 0x7, 0xfff, 0x5, 0x408, 0x1, 0x6, 0x2, 0x100, 0x8001, 0x0, 0xffff, 0x0, 0x40, 0x9, 0x3ff, 0x6, 0x3f, 0x5e68395b, 0xfffffb7b, 0x5, 0x1c, 0x80000001, 0x2, 0x4, 0x7fff, 0xba, 0x3ff, 0x200, 0x2, 0x3, 0x1, 0x9, 0x4, 0x326, 0x5, 0x5, 0x1f, 0x7, 0x4, 0x5, 0x40, 0x1, 0x2, 0xb5, 0x7, 0x7, 0x1, 0x8000, 0x9, 0x1, 0x4, 0x2, 0x7fff, 0x5, 0x3, 0x400, 0x80, 0x74, 0x8, 0xd7ef, 0x5, 0x7, 0x3, 0x10001, 0x2, 0x7f, 0x101, 0xd4, 0xe, 0x101, 0xfffffc00, 0x6, 0xea2700, 0xa9, 0x200, 0x20, 0x40, 0xbd, 0x3f, 0xff, 0xef89, 0xd7f, 0xfffffffd, 0x7, 0x910, 0x46, 0x7, 0x49, 0x2, 0x3, 0xffffff80, 0x73, 0x8, 0x37cc, 0x9, 0x80, 0x8c, 0x7, 0x0, 0x7, 0x200, 0x0, 0x7, 0x9, 0xfffffffd, 0x3136, 0x3, 0x2, 0x0, 0x3, 0x16f, 0x5, 0x7fc, 0x8, 0xdd4, 0x0, 0x4, 0xfff, 0x7fffffff, 0x45f6, 0x40, 0x3, 0x0, 0xb, 0x7, 0xffffffff, 0x7ff, 0xfff, 0x5, 0x7, 0x1ec2faef, 0x5, 0x3, 0x5, 0x4, 0x7, 0x3ff, 0x72f, 0x65e6, 0x7, 0xffffffc1, 0x4, 0x3f, 0x20, 0x80000001, 0x10001, 0x0, 0xf6b, 0xfffffff8, 0x3, 0xfffffffe, 0xbd, 0x40000000, 0x51, 0x8, 0x1, 0x0, 0x1ff, 0x8001, 0x2, 0x81, 0x5, 0x0, 0xfffeffff, 0x0, 0xffffffff, 0x35b, 0x1ff, 0x4, 0x0, 0x3f, 0x8469, 0x800, 0x8, 0x3, 0x7ff, 0x3ff, 0x9, 0x1000, 0xffffff00, 0x6, 0x9, 0x10000, 0x2, 0x3, 0x404d, 0x8, 0x9, 0xfff, 0x10000, 0x9, 0x8001, 0x9, 0xfffffffb, 0x800, 0x7, 0x30b1, 0x7], 0x1, 0x400, 0x0, 0x9ab}) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x0, 0x4) 00:50:14 executing program 5: socket(0x10, 0x0, 0x7cd) 00:50:14 executing program 1: ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)={0x0, 0x3, 0x2, &(0x7f0000000000)=0x10000}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x12}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4040884) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_0\x00'}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7}]}, 0x64}}, 0x8840) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x19d040, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000380)={0x0, 0x1, 0x1, &(0x7f0000000340)=0x401}) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000240)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r7, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r8, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x1ff}]}, 0x1c}}, 0x0) 00:50:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="034831df339432d01a4b5b36c466137e75fef45881cdaffd64477f6bd97063eb115f430b01455ff696adee17faea822ac3406f7a73deb5777a984b607d437a0d68a2d9eaf76cf1cea1ac14f9f20495fb0dd0811be2be2b204774041ff0647e43a0b8b7b09ab087cc2ea018a951bb77eb2bbd0e42efc586a5606ad3e976e7f9716e6fb0ed11a378c323e99cb0bf185cf3b5718006c68006243678c8cd45", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x520602}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, 0x0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x811) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x7, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040000}, 0x8850) 00:50:14 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:14 executing program 5: syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x0, 0x4, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x8c0) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3f}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48043) 00:50:14 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000000)={@host}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3f}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x78}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_DEBUG={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008044}, 0x4000880) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, 0x3, 0x1, 0x201, 0x0, 0x0, {0x7, 0x0, 0x3}, [@CTA_TUPLE_REPLY={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_TUPLE_REPLY={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TUPLE_MASTER={0x18, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x80) 00:50:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 504.286317] binder: 2405:2416 unknown command -550418429 [ 504.296586] binder: 2410:2420 ioctl c0306201 0 returned -14 00:50:14 executing program 5: socket(0xf, 0x5, 0x8f) 00:50:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(0xffffffffffffffff, 0x7aa, &(0x7f00000001c0)={{@local, 0x3}, 0x7}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000001a40)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001a00)={&(0x7f0000001980)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x96}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x60400c5) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x2004c000}, 0x20040050) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x60, 0x0, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e23}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xa5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x3d}}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010102}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000000}, 0x20000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r4 = socket$l2tp(0x2, 0x2, 0x73) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) pipe2(&(0x7f0000001a80)={0xffffffffffffffff}, 0x40000) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001b00)='l2tp\x00', r5) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000001bc0)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b40)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="00012dbd7000fbdbdf2506000000140020000000004504b2c6000000000000000000050014000600000008001100010000000500210000000000"], 0x40}, 0x1, 0x0, 0x0, 0x769fdd7b7ce56172}, 0x20000040) sendmsg$NFT_MSG_GETRULE(r5, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000015c0)={0x11, 0x0, 0x9, 0x8c, 0x1000, 0xffffffffffffffff, 0xffffff80, [], 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x2}, 0x40) r9 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001740)='/dev/vhost-net\x00', 0x2, 0x0) r10 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r10, 0x0, 0x0) io_submit(0x0, 0x8, &(0x7f0000001940)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x16, 0x8001, r2, &(0x7f0000000200)="9556c3070b0a6d6ab4d83d40fc1d8851988d606eeb41894acbe91276a6ed20a9bb0c562f30547869f11616e5ae08e10c74a22022a3225775b7ed4b582b855233eed3e359ec26d084cd", 0x49, 0x401, 0x0, 0x3}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0xfff7, r3, &(0x7f0000000300)="7ce35b0ac64b2905256684ac170ef22bd523f3da6f0df344d1ef732f25913ec54fe82f235719a9117672ea47aee20ae9af1deb88367705232437919500868db199e72fa7c956df491fba2cbc36724e47c991af1f2fbfb8d4b21871472ff28d7e2dd589b4", 0x64, 0x6, 0x0, 0x1}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x8, 0x8d45, r4, &(0x7f00000003c0)="5b92a6bd15b33b3717bf16663f12ff77a1a474a825a13346f0844c2c6d9923f769af27b12674a78feac11c6dd0944aa53f8e4325cb2866bf129d66d54aeabc3ac9de946a3f11cb6bfdcbd25f1db9a367202fa4449293aafa405ea05896c5472d778c2e1b8a106cfd35fe3a558e9136768ef57204cb05861eed5ba06890c920a1bc73bcce83dca8be4ad1c592f016224629b40fd4994b6941add6329bc83789c5", 0xa0, 0x20, 0x0, 0x2}, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x7, 0x2, r0, &(0x7f00000004c0)="d7cf6d840078a82d68847cd8bef32ec39e38aee6ec1d9813cb38b584010fc2bd1164cfece860dfb7af7377acf387013e8059903c8a588a9dcff838026d534c5547d1ffd0ae4a143b27cb85cd7f85b914f7f574b1d2787c013fc50f397021d81d69b2ed3802c2d87654d9a58eb7ffa62e151fb389dd5bf92bdee4ef48fa8c06cff4e28db9b1fe4e3fb7988bded516c56b0238bde336b04efffd5ed27d9e9d751f16dfbbd7fa1a5d135b37e64874e142af3af182e524a359436e783403404e7171d69543dd9660f1da515fac962af018424a10190d0efcfb69cf37f8b1e3bb1d7a4bd85906243e8792ee3f1c83ef451355c7dbdfa1b2fcf7ae965a88c74098228bcc073d383cd14d253d633ec9d6e5e2930a3d53199c0f6ad3038c785648cce673958dacde0c7e5b5e62b468d8dc1bb8d334834f169acb6ac867cd5e00e26a8d2563b8eb263c10e53b37b627e0ccc432967502febc0720995c05b87ba4fc3e3e8ec61066bce0c405fa2f144ec340cb80772b67074208f182904eed89a15d047d4455b5fa33414acae8dd5c940868635d307050743376c6b18a76cf57a1451428c5e2a4dd328c5c528245eee31faa0b369816808fe389218f04a345f903b544768c557a80c60af0cbbf0381169bd98b392dab9f73d747d571bc464f2a7ff547a9bba96a40bd51a08fa5631095980a798065a8c2648822af4ff38f243e57d97ed649cc56d051a67e017dcc84b62930d161422c887bfa07bfadf6e38835035cc6fc05d933f262ed355bd414b163abf110046f397e31ed527249d93dface01631f6ebab9f47f357acd7ee081483a76f0e219519e3fbbb1f2fdd1651ef5c6c19a5aa80a65e286ff34af4e02e181913a982b02dcc674f753d979d8d133e4994fd3038991dbfb54efa2e7a93103c5997c285f43fe9ee5f1848bcbe899e1155e015cb4b8a5026f20227e8b02d855fb9dd726fe2920ba5755afab085e91475528544082289f4b03b992a56297e4de48d4b0025c728bac09035d22041baaa3f2ca1028e05b2d0f385925d596152955d12d0095bbb3acf4674e766d9f9f8d04368e34367f989744639a5fa37fc3aa2b766cb2381b2d113b4f3cf4f5ffc170f50188f678a14338d87065115bf89aff558f1e5ff374094616f240015fe99f2a0c0d6246660f8b4f489384562bd90437195a7ebd477775359599963232717b143a0a107b0e126de559db78f88340220fc95cbf9da67deeb348b8fb230e9f83518f59d8d9067e9e9869735303d135d73b859bbd756a8cd6be152a12eeba0daf10fe61c57ce7b584a6b6890c2e9570061f4f09f62ac68f4a2da8002b274318e80791d1a09916658cef3021143574b1038da69519691fc1f954075246c18327f2e5d167ea32b580a0c741a63d45a7ecedf80637fb33748611cb7e846cd0eb87208bf9ad737215be809650d199dad2bf21e57be75538406c18af18d4472480338366ef247a22f6aea8838bbb1547e5c1bfc5f10c9c6282b1cfeed84c48ade7cdb4e04e7f0e14a79c30b2b156b091a1ee8e023ba2a66cc0e7743312ac1ba7057acd945c58b1573b1dc1418c66ea3cb033ef4899f033414d70559a6ed4d67fb830360597fe5f1b64a282c7e63b1be85869749802f205c9e90beed7169b60a5751b0f1436549d2194d94790b295608dbc38ed315939d8b65e010722e6723bff2b67d6251516ca91856e99b0102e0060d7911ac989220b38c5184153642775edae4c8236723fe5ec6ca853d5505b42e8a82d59f6ab6be41291f97e3ead332bc9109085ce0e653958e72c2b133a9fa7eb5bee60768796849a713ede3beda68044e33151693aa43b96ba690b63b3d166ec86171761afc4d57c7e693a548c8f19384b016b62b8bc1cc443dddede2731711e43fcf709b17c80a4cf5a49241affcc1e31417c9239c9d6dcec597fb997ad0cbf26c825f90bc90ae973692ffd91c85ae03b72a4e54922e7abe390a82d0bd3e63278522f8c95b65e538f6de998ba273c7ad1f79480a565386cd9745b376a9bf18b7f7a53296eb411e4980a0edc2948c792fe384d283c6ab5e6c8cce760fe5f6bbe404d779f81d4b4710e7322e2680b510e005ae3aa2361fc12b763b1abc6b72a4623868808d22fb54f78426668ff624afdf5583d575871e7cbc8159f35c7ba61c03a17afd5d8058fffe7325ad31466c6ea0343f6f14728309afffe2e0e5d02dbf5f6e7bef7fe530d5a58b4bd13b6f992ea1478fde9c999f68bfd1e317cfac9d4c12439f9719ab3ef904a54a85c6394015da56488f0b724ee956250f09af6b3da9fde5327f8798f0216480408978dded18cf2aa2f151e85eb01981bedbbb8a60f40a1fa3795f1e5846a5db27f817a5380cdff2c337e0ba4ca05f0c0209aef6bb9de6960fad0234cd2f9534da86ee48642f6064d0eaf81200c4d015a4b9b42148578c6ee80e71970ac02571e675534d5df23ee77530f9ee1ef1814913a081d84f4aa7874f2e59c282be61da63bc846275da062329abe5c6f504a29c0d319fd60ef0636e3899791302746cdcf3886a802b98c28103cc4eca396156e80e36a0214c79e7c1e0d7f145361f5b340529336d2ef8a41781e3037e3407903ab890e6ef9e13a176e6fa854adac87847c5ddfaf2592e551aa0808d6d30bd7bd7668e3fc0a7f5d4b05db10863bbe60d3408bde4076f8bed030bc619cb526bc7f5467bb68f4cb57a3090cdfd9f3026a6ad36f794ad2de5b410c5def520eaac8483b91a6b2eb71c4caf636e5fa8b489a6039e53a9abc89eb1fe5f33499f928be52d306401cf04669bf2c471a788b0a7fb73157dc639df4c1ea6ad3c909011c8f93ff4c72291b0757761e03e8c5fc357f86fd2af53059fec6a20df4984bd595045b79dda66437b2dd1bb55b09736e53e954389dfc61c5f3ee3f840bc5014617f012b43037e513c1fada9fb0be99a014a58890634b765423c7f85fc830e11065195964eb184a61191210ca81f060ed33b9bb69148971b8f6d79255c6c8193b79749d24b1249910e6ccfc017fe00e66d3f30a184a7c4ac3f583a141f62338b7d5be5e014fe9e01b6ceea68f27bbb5a9107e713d671eb5fbdfe0d0a1f2d578cf7eff899c4f6a431f9303943b7ef7a3419ff51cf198f53bb449172953e6ed09e921aaea50d3dbee755c683e46dd6dc39b1071c35a6a941eed7c3813ef41659f648ca29ba4ec108373dd96bb2200c4af8e6b79421281c6c6a9e90684a99d0f8c90022540a7981960e93768269cdd17e41dcee95203e7c12da62eb92a2a64dc2a7fbb5544a0d3df11e63dbadcbf6b2535ad496e0e7a09640cc536af712dae4ea089b92836c39980d06aff9c3beb4465590cf782bf952d3140a8017b45ab88dd5fb0375d798e8212ea61bf2cba1cec57f841824644d6aa5927539d0fdd39c56b83a47b4274ed834d91126171a2afc10b7699ac89feb19485bbd0a6ad67c4c05f9ff6221329fb4cd6179635f64e404a47832557037be67bfe90d504e4ad9d4355cbaf195d6b85d494ffbb12941c04636d29c84af4ea752f1352e7342c98fba87a22e95890c62b16d389ea45204220ce1a58a1cef7760b1d36e262ce1fa2191253d35a56b4b4d3b933b1386eb3fcbb8e979ad42a625f25e233d5e9d4574d19d077110ddc20bc594303b17310ede57144dc6734ff73869c7c377d05a72825b0897526513ddd6e5aed3280131cadce7415744bd508402660b8c9dacf30a1aa3083903aee1152fc9d3b9169f2851c30a0b5fb4cb29a8b95168be4d7de50feb1c6e2ee9e103195fa740d906de84d77af8df85f0c984a04d3d739f9a1b4d95ad06bdfa21cdbb306ede9cadfe6d4e3b777e8b4204cd3afde7d3e85bd8f0e6dc84c14086483fc99f4272d0b150f77a201e52d7e51bb9fa32375b6011f57f53eb4d613279c24ff86a9f63a5f102fbed6dabcc0b75e233268cace2d49cbce68ca16c135f546e9d7a15893c57560567666635a2111b694724f73a54dc8f4e8fb4f9707e3a99881bc7e14b33200d1a93152139e2b869413227e9f7b26ed62f12dac24dc27d7e441f4d79a1772ac00aa5b9b634b2675390392ca7ff0ef20b3dc691aa0576c83a2044efb48e7bf7918b31137563e884868ae08d76356e35e693897acb046957cdf7b0808de2b68f69ccb15982dbe1ceb179ce87f3f0f03d91955a398bea45ddc99e8c6c180c76c570963a150154515d039af135e729b1a1b0a88e84f286200c614d08430296d00506f1e4e3b28e4396c01a50542decad2873268ac867f3aab9901f637e11711f9039231b966e163971e9d36d188855a8bbf1ae0d66c3d9e7c1f5754464692c51a046162045f19560b7c786b41da1c3f0fc406365a5b13019e76dc66aecfbbf879e2c8affb8f6c9b6a51d261cbb0698ae34652b8dd5eea0f46a5a97e6cb345ca92fa774d374eef44ab412f8510ec4da635a98f63797a3e7d5d7948935a467f53a923d2ec4b1d175ce5031e762eb15a6ecaf24e02886884700fff5a758b2994bc9ae710dc488592228b72e4137a7b8e7aa89f74a2733ebddd47911269d9c5ed99fc36592d72516733bad2286ff106e7e07f3631d89442fb45c9a60b28c0655a0fd7ac84fd0d0580c918fb13c76b0fc540f8e4284e6e4cecefc7270a11d69a3c53d863f41bb623350d330ba599403bb4ee4af3a5470b13374d433a3a78e9d8766f246aa6eec48de426539c6c2a0424c3d04bd8936fd0cdac2e5f6fff740535024a4a24d37dd95b40407ff0327b09d14571fa993abdeeaf667fc30675d1e874a7a3e9f376108fb81aaac6a5c8dbe6368272145dc9e0174d0f243af12b0727687f121c96ff05c9ddd55f8e140ebbe3cdebcd1c9e0ccd3ce224fa057e85daf542658c6e9b9b80549b06b0f6a3137cf42aa4bbaafcd93e896c61b9f96fb3d9eb15930127a84ad03dd689e3528195a53458b6ddbab013c24713a8d3b65cd6766a3aeea65a98ea430fea81838e3254140024bb3e6e40e41ca9be4c1546f7761bcf493b2e3795b03ee69b0b08dadfc4f29016aa402cf1b998b375c893eacdf36c5ac10221465456469820584d1d7ce94ed65b73908b2ef28e3eedf0e4ed676df05b2e92c420bbf7e1aaf8b2e59a601505b7e400d5d17d8d80045996ecd981e6695d20e23e748dcbf324d012fd9e603c475a6dce326303d44c7dcd5797ca1efa0f2278fc9d7775c0ce3f31a41ba1b25d6ce244a78fd622cd5a60dcde73d56b7abc8a9fc665b0e54e075da87e8f4cd8e0518b5fcc48d3c15479de3eaa4d559f227f303af537b52149108c78b00dfb29f5c3c538bbc8abb60bc34b7c54e75d9b14efebb4ac5f018c9d5edf5f6f8ed7d4d30427c4a8b999a99b72ac945b9082e8a7df3d94e055257e1c2ca13be1d7882a0bf1975ec4e3ceab37237ca379529aed489db87eb0a677861f2be91aa88265123ce47242a18258782ceb89936622f329a4aab3316b4a3d0f2b0093bfb609df012ed900216e8ba84909652e96e7790da471eb9ff337d838c59843a43a66c9f77f1a27a5110f2d3119d5d6075c1d5637d9d9261fd0ddf39d09f299da61f4aa343648ff34e54947750ae4909beb5f038ba12763a2e58ef2b3aaa0a6b5a11c5e6308e7848ed010c1ffeba33db7c3284196c1aac8c53203b63c4ad2e331f9e971f21e7b08b6b2ac09947f01615e9c9ceafe26311c2b454bd75fabbcd5a120dce2fb6b56f8bdd782c8fe0d5ad940045a750c5cafc8478d5117543529ef0db344513496659c0ae24f8b52ffbca59903f5db463b04f6062a60eb8c187b", 0x1000, 0x1, 0x0, 0x1, r5}, &(0x7f0000001580)={0x0, 0x0, 0x0, 0x7, 0x1, r0, &(0x7f0000001500)="6d2bca116fab8de001182af4b86d5fcc488309ae83affd6de5ba340f1736582a0e7a9a52b75e6d7de7ce31ea50bde1dc56b56bcd6b51cd292d20242c21e37b893ebdde6fb8cea5c21b1682cf304198315c883a1793144de7d0067cfe982b024edebcd2ac36cdcd760b1b466069431f65bfdc1d", 0x73, 0x5, 0x0, 0x1}, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x3, 0x0, r8, &(0x7f0000001600)="303df6864566117d19282d34fc3219f26f38feeb68e385a408d8b34f35c8f640d3074dc4bd412b79a027c02d9407fe1997973c71a3fc71fbec08d291842206fb3e6991cbb9e1e60be07f97a78903d1f0906f9df9d26baa4ab9fee29c957fbc7b1ffd7b7f7f61789e785f94e9191981094fe8c0c67119cf1da39d13e2b71967d6d47b1db0742546d76f31758de7b3a35d6b31e0f6813a97f43110d2c875441294bfc5f900ad4888c252078e39153d1e5d160cf91af481b29de5b6da242cfa82f2bd7a8eb12ed20c1b55480fe51f100d7132f1c4215fe1c3b39a85823393", 0xdd, 0x8, 0x0, 0x1}, &(0x7f0000001880)={0x0, 0x0, 0x0, 0x0, 0x7fff, r9, &(0x7f0000001780)="6bca6be5a30e689ad4f4f72335cd6c111b6986e13943b67980e707043318e100dc893e70cc778853a5753d4dc51f3b1dd43ab7b343d055c601cdb8a8e53dc2b735121ff59ad00090d40230cc78abe29d56b692cd478fab795dd5ede9ba1d8275e0d8972ce042a9c46a683052773beddb723ab55c2e4f21a5d0076ba34d84fae8ea2e69cf428bcf67255163a648d7eca51169e185131ff33b241197b111432666ef0db893c203abab257fd3b28f7b8df7e3506b29651807735ba5670b478a3631263cd7fc3bdba295", 0xc8, 0x8, 0x0, 0x2}, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x7f, r10, &(0x7f00000018c0), 0x0, 0x101}]) 00:50:14 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x0, 0x1}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 504.346203] binder: 2405:2416 ioctl c0306201 20000800 returned -22 00:50:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="03c30c40", @ANYRES64=0x0], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0xed43) 00:50:14 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) write$vhost_msg(r0, &(0x7f0000000180)={0x1, {&(0x7f0000000080)=""/235, 0xeb, &(0x7f0000000680)=""/4096, 0x2, 0x1}}, 0x48) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000200)={0x400, {0x2, 0x9, 0x7, 0x7, 0x8, 0x7}}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x92}, 0x8) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8080}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, r1, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000001}]}, 0x54}, 0x1, 0x0, 0x0, 0x20004050}, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)={0x1}, 0x8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:14 executing program 5: socket(0x26, 0x5, 0x0) socketpair(0xf, 0x4, 0x180, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$l2tp6(r0, &(0x7f0000000040)="3fe8bfcfb6ce1d5d861aaca1a048373b548f065929346edb4d44738cbc182558b4c08ee11037bdae68e61acd9020f2", 0x2f, 0x0, 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x7, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) [ 504.421013] binder: 2427:2436 ioctl c0306201 0 returned -14 00:50:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x5, 0x2, 0x8) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:15 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 504.552497] binder: 2446:2453 ioctl c0306201 0 returned -14 [ 504.553152] binder: 2440:2450 unknown command 1074578179 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 5: socket(0x27, 0x800, 0x0) [ 504.596895] binder: 2440:2450 ioctl c0306201 20000800 returned -22 00:50:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x7ff], 0x1, 0x0, 0x0, 0xffffffffffffffff}) openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000080)='net_prio.ifpriomap\x00', 0x2, 0x0) 00:50:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, r1, 0x800, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private0}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x20}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xcb}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040}, 0x84) [ 504.646359] binder: 2440:2450 unknown command 1074578179 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100}}, &(0x7f0000000480)={0x0, 0x20, 0x40}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 5: socket(0x2a, 0x5, 0xfffffffd) [ 504.688038] binder: 2440:2450 ioctl c0306201 20000800 returned -22 00:50:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x450000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, 0xa, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x80000000}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x33}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffffffe}]}, 0x54}, 0x1, 0x0, 0x0, 0xd557cdb6699e626b}, 0x20000000) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000180)={0x2, 0x9976, {0xffffffffffffffff}, {0x0}, 0x4, 0x9}) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)=@newpolicy={0x10c, 0x13, 0x1, 0x70bd27, 0x25dfdbfe, {{@in6=@ipv4={[], [], @private=0xa010100}, @in=@dev={0xac, 0x14, 0x14, 0x20}, 0x4e21, 0x100, 0x4e20, 0x6, 0x2, 0x80, 0x80, 0x11, 0x0, r1}, {0xb5b, 0x1, 0xb0, 0x100000000, 0x0, 0x5, 0x0, 0xd86}, {0x7, 0x10001, 0x5, 0x7}, 0x0, 0x6e6bb0, 0x1, 0x0, 0x3, 0x3}, [@tfcpad={0x8, 0x16, 0x800}, @policy_type={0xa, 0x10, {0x1}}, @encap={0x1c, 0x4, {0x0, 0x4e23, 0x4e22, @in6=@ipv4={[], [], @loopback}}}, @lifetime_val={0x24, 0x9, {0x0, 0x1, 0x6, 0x1}}]}, 0x10c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 00:50:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_xfrm(r3, &(0x7f00000026c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4e1bc76872021e6f}, 0xc, &(0x7f00000005c0)={&(0x7f00000000c0)=@migrate={0x500, 0x21, 0x300, 0x70bd2c, 0x25dfdbfd, {{@in=@multicast2, @in=@multicast2, 0x4e21, 0xf6a3, 0x4e22, 0x6, 0x2, 0x90, 0x20, 0x3b, r2, r4}, 0x6e6bb7}, [@policy_type={0xa, 0x10, {0x1}}, @algo_auth={0x104, 0x1, {{'cbcmac-aes-ce\x00'}, 0x5e0, "4d885364c4bf96d815450146c0a3843e41dca6ee6513dee4955d139ecdb748b28d8557278f0eb5b320ec1244a05f7ec5e7a790438cd08f5e0fc071256a78a290f24f4e90d93f986800296890e1d1911e0343193132054752df7ad209e4a86bdb6e7f8488a3f20020ea03d0a3cf6df04fd5e4d17e42231a0577917b328f2338dcc04d0d304cff4f38cb003f8ca71d7e063e45f8e1c46cbbeb93b6e0f60e80728d925b9f1a224f8e8d0406afd3099037c09cd067957e0e83919ab2c65b"}}, @tmpl={0x104, 0x5, [{{@in6=@private1, 0x4d5, 0x33}, 0xa, @in=@multicast1, 0x3501, 0x2, 0x3, 0x5, 0x100, 0x8, 0x1b7b}, {{@in6=@remote, 0x4d5, 0x32}, 0xa, @in6=@private1, 0x3505, 0x1, 0x0, 0xaa, 0xb0, 0x7, 0x4}, {{@in=@broadcast, 0x4d4, 0x3c}, 0xa, @in6=@local, 0x3500, 0x1, 0x1, 0x2, 0x7, 0xffff0001, 0x100}, {{@in=@broadcast, 0x10000, 0x33}, 0xa, @in6=@loopback, 0x3501, 0x4, 0x0, 0x1, 0x40, 0x2, 0x8}]}, @coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x2b}}, @address_filter={0x28, 0x1a, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@rand_addr=0x64010101, 0xa, 0x9, 0x9a}}, @user_kmaddress={0x2c, 0x13, {@in6=@dev={0xfe, 0x80, [], 0x39}, @in=@loopback, 0x0, 0x2}}, @algo_crypt={0x131, 0x2, {{'ctr(fcrypt)\x00'}, 0x748, "a9844316414565f563facee90054c97118d4e57c4f81e006f186c4057af72a3eda9f40f64d6f790f591d4ffdd3356de6b29a3388d2198086ca2d70815b5d62f76e2b6ede9dc15d41029b9f31b00f2c3eddbba8dbf28f98df213f5103cfa24b126c10e7f162844e9a292e155a3c7ee51ade1f649b37c5b7c20fa293c4d4a35396724db926c6d7b7d9b9e1fed2e48473c5b6957245c2a68d7b46c113f5390244b5987a2895ead99c182c0cd7e446175491e64f81456d68851238893363b04fcd0b30ad2b5cc694cd049dc0ba59cead7b70f34c0d0feb27b32bf19f73b3b49a6f9687c40b4be79a7f4d6f"}}, @srcaddr={0x14, 0xd, @in6=@remote}, @sa={0xe4, 0x6, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@broadcast, 0x4e21, 0x611, 0x4e22, 0x5, 0x2, 0x0, 0x0, 0x32, r2, 0xee01}, {@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x4d6, 0x6c}, @in=@multicast2, {0x5, 0x4, 0x3, 0x8001, 0x101, 0x7, 0x4, 0xfffffffffffffff7}, {0x9, 0x7, 0x0, 0x9}, {0x57a, 0x2, 0x5}, 0x70bd2b, 0x0, 0x2, 0x3, 0xea, 0x60}}, @replay_thresh={0x8, 0xb, 0x1}]}, 0x500}, 0x1, 0x0, 0x0, 0x40000041}, 0x20000000) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r2, 0x100, 0x1ff, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x24008085) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:15 executing program 5: r0 = getpid() ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r0}, {}, 0x37bf, 0xb}) syz_open_procfs$namespace(r0, &(0x7f0000000100)='ns/pid_for_children\x00') socket(0x26, 0x5, 0x0) r1 = socket(0x4, 0x4, 0x7fff) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x13, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004}, 0x10) 00:50:15 executing program 2: r0 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xa0}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r0}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x80000001}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x0, 0x0}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010100}]}, 0x50}, 0x1, 0x0, 0x0, 0x40800}, 0xc0) r1 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="92ea0840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x18, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death], 0x0, 0x0, 0x0}) 00:50:15 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x8, 0x200, 0x8001, 0xffffffff, 0x84a, 0xffffffffffffffff, 0x1, [], 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x40) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x17, 0xf7c6, 0x1, 0x101, 0x20, r0, 0x9, [], r1, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x40) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.memory_pressure\x00', 0x0, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x5d, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20001}, 0x4884) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x18, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death], 0x0, 0x0, 0x0}) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 504.957810] binder: 2508:2512 unknown command 1074326162 [ 504.987805] binder: 2508:2512 ioctl c0306201 20000800 returned -22 00:50:15 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) socket(0x29, 0x1, 0x6) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) fcntl$getown(r0, 0x9) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x18, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @clear_death], 0x0, 0x0, 0x0}) 00:50:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) io_setup(0x7, &(0x7f0000000000)=0x0) io_cancel(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x2, r0, &(0x7f0000000040)="4f71c8cc780c85b32581607a91fe54acba83ceb358ff8def656bccb852a05545303fde5001087c50b9e7a2d8235029ea6016d5ff166e51321e77ba0e2e8dbb023a3cf14cbfa2223b48e7f4e9e28f5cbc8e63d35cbf0016a717bc4bef94df6bc19418a3c9529ceb5cbc0e92f848c4f78df00b308d4146", 0x76, 0x0, 0x0, 0x6}, &(0x7f0000000100)) 00:50:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x804000, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x3ac800, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@access_any='access=any'}, {@fscache='fscache'}, {@debug={'debug'}}], [{@defcontext={'defcontext', 0x3d, 'root'}}, {@appraise='appraise'}, {@subj_user={'subj_user'}}, {@smackfsroot={'smackfsroot', 0x3d, '8+\''}}]}}) 00:50:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x15, &(0x7f0000000000)={0x0}}, 0x8000) socketpair(0x1d, 0x802, 0xcc0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0xd75}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PW_TYPE={0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x20000004) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 5: socket(0x26, 0x5, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x0, 0x2, 0x0, 0x0, {0xa, 0x4e23, 0x7f, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}}}, 0x3a) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f0000000000)='syz0\x00') 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:15 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0xfffffffe, 0x3, 0x7, 0x6], 0x5, 0x80000}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000040)=[@acquire_done, @acquire_done={0x40106309, 0x2}, @exit_looper], 0x0, 0x0, 0x0}) 00:50:15 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f00000005c0)='hugetlb.2MB.limit_in_bytes\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000900)={&(0x7f00000008c0)=[0x4bd, 0x8, 0x0, 0x3, 0xffff, 0x6, 0xffff0001, 0x10001], 0x8, 0x0, 0x0, 0xffffffffffffffff}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r6, 0x0, 0x0) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r7, 0x0, 0x0) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r8, 0x0, 0x0) io_submit(0x0, 0x9, &(0x7f0000000b00)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x6, 0x4, r0, &(0x7f0000000080)="efeed9833ef39e9223ee02bec999aadc667efbee3f3b9a9645021d9959933a6dcc8fafc19ca7bd4dd55e9815d7f39b2aaa735576b3c68dfc20b6e791c7d2f5a2897c7698cd232924ac53f6532f11f0835bf979f1678506b59ff440be3b993cee28faef9af667a41710c7fe51fb0ac53f04e5f1f4b102b3d7a8c16ce12c5f61143b422274c7c23ea61cc10f99b8362ae6e7f3d3976486c10026b0190c6ce2adb0", 0xa0, 0x5, 0x0, 0x2}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x5f, r1, &(0x7f00000001c0)="1cfd81b8e300649ac3ac6e0ce43c5477703dfe863d079198579cb7794a885bfaa0bed7bc8cc1010462b17fb685a1423bc0ec47f1a930fb2527b14df4d7eb432e1b1e2ae209bd3eb6caa3b6636835d0e7f4469841a2b97f217bae8acf64f9e5687b337a026c4d24c4c155a558b78375e804a8e59fbc04198e1baca4aa6ccd9ac8d3b3d646bbc2d1b42b637c52f655a375e5f3ed30017fa27cc979733f741671b4edc77efe8c6d7190443bf5eeb50b1ad57f813bcf1480cad7fb4834e03089efeaef3ae44724be330892560f233c96208f35cd269c67a6e4d3a392b65a9ca226bdabad886eb45b988a54d2ab94e1c428d5526ca9b9c6678d09515b", 0xfa, 0x0, 0x0, 0x3}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, r2, &(0x7f0000000300)="80bd33d796a4db9e7ab31cdedcc2a93d7751a41fe8c121e97f7a7fa8281543177cacdce8e673451fee6171cd5f4a65b0ff8a36c2a9f8a463111de098266b704c58821c83ad790b409a0f562838b655b3e11ec97159789c12f0b0bf9977670ddcb95a1f691e9aac01d30552082f88299609b4fca5315a1b605c3029006397cd314d5836ac71a5543930e2ccb79606b928d001144dcb585dfd8f880e1bf16abc0d36f006d3d9b3b8567ca9f7dd3e82e49a111e0614ca68df3385b28e33d2284989787c9ecfbbd7e9c3621bb2809f9e666cb5a06ba77552275de79dc8ea", 0xdc, 0x1ff}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7, 0x7ff, r3, &(0x7f0000000440)="7c1f6f4892e795b37bd685a583ba2b733d1cd0dc7e762af7cc5cdd62e2eb09fc2d7406a6c52916f9dff9c68106a8f38d132f0a866f77764130ac52e4e0c40991046ac8c20819f5973ce7b233f098e5213cb12e64f2e3ecacba6681b075cfcd68beec9da36179215d6b0761652d9f16fbb24f37c93503758e6854cff158ca18d8c474e69a823a8c61e0eff77fc08bfafea469e2ff9de13c8c55bf806ffa28437e234926aee47c610101334ee58dc507f01437a7ecedeba7bd929d55da72a3a06f94c362cc4437c6f9c69fa9d10caaf35dfe04dbe78d9f6584809be644b2265a3d7656e58d6f0dc02cd288de53a713b99c35d57d74ff32347961d5", 0xfa, 0x5, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x9, r0, &(0x7f0000000680)="9b986ed12a32cc96142ea380a7d9d34c3eda598262f12b4ff32a3d52f7acd5e4d831f471209a4eeda0364cdc505d4fda0656c9b7c8b6f7340ecee5eba07f2dbb30344faf1d1428b7645c9ddfffc2c1321943d1f4786aa62432ea1067223eab4068b067dfd71952e7d8934ee142044999f59ffcb22375f4d5041ac053f74d01e6a44bca8a6713c6120cd44345f9aa3ac9fd04a7997fafd1bb71ddf469c3020657fb27303f0f9d8156e1ef0d6e7a5ab63d0973d4", 0xb3, 0x6, 0x0, 0x1, r0}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x3, 0x9, r0, &(0x7f0000000740)="c79376d344cd574dcf408b5e2a67af32e186479b3a1a4c9b6614dd38b8122a23936cbef25bf494e5fe78ab611354e5d239b2e06c74079b74d561102d1cabde04cdf120", 0x43, 0x3f, 0x0, 0x0, r4}, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x2, 0x3, 0xffffffffffffffff, &(0x7f0000000800)="7ad4edcf062f8aee54333267c26eac0bd554a1ce532aa1796ebb7d39ec29e69faf565a56af20605e160ee767c23a48a92d60ddc14674ebc35967b27bbfdb264b4f970439fe6708858915ff66f67de1327cbe58abab33488571a9eb8d2775b86b294af47f9f232fc9920c257b28b4662e92a53d3c9852933e4537af5e2ccc72c8a3d5a5df5c269bc4be03bf104fb5a8ab72b52f10d63f854cf4278c3f3db8733a2d5a34075d739c6601de2744f578d5771b3ddb94487b72620f9c1fcc2d04", 0xbe, 0x7ff, 0x0, 0x2, r5}, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x7, r6, &(0x7f0000000980)="713a99a5a2993417", 0x8, 0x7, 0x0, 0x0, r7}, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x6, 0xffff, r8, &(0x7f0000000a00)="41c2054061f1474e2d558bfdcfb25ea2fd8af793ee71f25a3ac32e7cee82e4122ce538c8c348457125c2414e4dca70b573c3e6ce005b147ebea464f9f173107faee77972a37036cb1af2cf4e279d0ff8b10dceeba185b65baaf5bb1b5400f063241cd53c0254bbbfc2d89c67444991231fb35fa661f50f8ccf475c560101a9bb571d4cc33ac39ff67901e584fc2400b2e9dac1ea989fb22bffa6eaa891a3271fa190919c880b604e5b4961886d69c2249eda0e00f7702a27d1cc4308d6", 0xbd, 0x1000, 0x0, 0x1, r0}]) r9 = openat$cgroup_ro(r4, &(0x7f0000000b80)='rdma.current\x00', 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000040)={0x2, r9}) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x2, 0x3, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1d}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x101}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x6, 0x2}}, @NFQA_CFG_CMD={0x8, 0x1, {0x92b858e18615866, 0x0, 0x11}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) write$vhost_msg_v2(r2, &(0x7f0000000280)={0x2, 0x0, {&(0x7f0000000100)=""/101, 0x65, &(0x7f0000000180)=""/216, 0x1, 0x4}}, 0x48) fcntl$getown(r2, 0x9) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x138, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 5: socket(0x26, 0x0, 0x0) 00:50:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x282882, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x14, 0x1, 0x37f8, 0x9, 0x0, r1, 0xc7, [], 0x0, r2, 0x0, 0x1}, 0x40) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x1, 0x2, 0x401, 0x0, 0x0, {0x7, 0x0, 0x1}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x400) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x800, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4c800) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x14, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x2}, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:15 executing program 0: io_setup(0x6, &(0x7f00000002c0)=0x0) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) io_submit(r0, 0x2, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x3, 0x1, 0xffffffffffffffff, &(0x7f0000000680)="7af277162c527eaa43461c7cbaa66b350462d7927888410538c173788376f49f2e2d86838dffb443f09a9f3aed119519e5b4cdc8042b811b404d849cf2828a61a084abcb4f19c8ebb824cdece2b63c843875f7f02a3d8a79eca3be406b75a182ddaf78728e8a902fc5640dfe0d7436f2acb62018735a9d78288950471228ec99aeabaac9194bd5da051c089274b59ddf42f1de43c6b582b8ec90d4d26d5c8dfd3b183948771e4503f4d0cd91154d63bd0b122317651199d6525f0ede8efc7e9bbbd042696b0091dbf058462b7c21213be051e82172130cbd7a5c5353ced4bc0ddc0ddc4393deb557dd7ad7d64c1256191b5db1369502fa6fa25c0b64dc18e931921d06de3c0022a3bfdc3828acd2d78ed26a71e8c45e3fb7bbaf18b9b270c57674a12f3002d643e9249c376cc972718fa9e5fe1d7dbb113388b313c48e061afaebcc961603dcefb13892c5cb2450ae1b705ddddd71a2a9ed9fc427f841d3630e867e4878578d7578c6e0f581c978c1866c86bd0e3ff26c46ef2eacfab582bd0efdfb0587177d5afd1892e248eaf58210c3bc1a731fdccaf59a61e5cac2f7fd0983cdb2df6902832d578097c765180fb53c6f903f12cf4b580fb98cb14b6b37685281fe1f267cd9e9fed4c1efd7c8decd1d5ac2aef8087c2823df7493a2b040217892de2fb65908dbdda7059338e1ccf29dbbf1563875407a40ad21fda72bc8e00db146dd22bc413ab959b1d943fe4f0f1ea743e2ada8676233806be160847345b6c43afb4978963d143bbb9845054bc0bc8326016af82ce448d94fbabad08cef05e4650c1b838f276e96d0369f349b23ff959b21777119e6896c385c625fe0290de7740a30f04ded34bc40e29eac0867705e11c1009992ae3a395978f7bd18f0b4f2094b0ef3355ce18e69990c4a9ba3c2cac40ab398999b4b9c2ed5cb745722956f88698ce7c8821a684ec881fe7c357f7bbddc1cf37c70d015c0023c079bed64b5e21ec9a3fe10bd1db89a26825de31f72997179c3f502724e1cd317c4618d78c723dcfacee282452b71e848408f831357d5a5e43811f56cb27a73efc6de080ad60468747e78344b0e3e374b0ae9d4f230c9abefbc93949ac8373fd5c19a0ae06111afe33e8357bb7aace80382bf54979ee6ad0e5535109a688f896c011228ce98c6b9df2050095f1faf9ccc10e9a84db61bfa0f16f331837afbad4f88652d400574d7229914d9c2c195e42e39edb2937ed0386870a7089c4d75f35264227d08a08e14974482b74a71a622eb694cc1d5b30f86072027be0ff552f8a02744877059e0c7e6a24ad12d10675326798fc780724cf90c35d5684642608f9be50d02b4c7f31469926b4251c597897bfe8e077322c3211036eaed3f69176d1ce4915bdf24fab0efd4c10d94559706c99ad42549933a43b9c4c37ce42bf633e046491350c5363fa8686568750379e08bff7b1a779a161737bfd688eed8c08aa382733b55f150ef28c8a591695bb70f07b48fb765a30f0ab76067a6362f0d4e9843a338e775ce9c06173013b89ffbc76a39f4afe4bfeeff2f209b90b6811d57c895f1f65994943eb75151ad8b34533eab9e9884d584e8227f89fc475a2ea2f668a27fa377ce7919b0feaebc4457e5baf89d25df012fa2f90cc429ca919a2c60f2775851a53ac02b0996479654df2bf22c3b4a441d0c7a58380089d33e656dcab207a29caff47d7dea592209248724fe3ba44d7e61c688f4adfc40a67caa3e8e4693ee42fa7c6dd2144692cb7ca80324b7b8885425a32ead49886f0caac32a627a20bc6994d1fdc72b8147dee432f377325c7cc88f0ea2533224d8367e3606b5e827ece0d059b8e0ba35d094a5a672e70d016692aeee62c9b21dcb18e0852fcfd46941087f888009d89ae3add2a818568e28c6b78fbd1bb2d5180c9dc53312ea8d4941fe86e928637da754e69ff5b86861b169e427223f83fa4be5ec75c373290045a878e5e634cc6003e0b7c10616a57828f716425d7c886ee50f4824d3e152bc0ac6f378c7e9811a5cce88e94036f871dc1fa608c135cf42fdc8cb10508d7a7a92698b4a91e39cf24dd94c94d44a9c04a0b9361a802de6ee9262bf579a7a76625e22551ff0da203830b48a1822cc29f79354c3f50a0374f23c04a2c0cfa0a34bfc3ff8ad066a1550935a9c1d121651dc09e83cdce1cb09fc00e98e2045c28f5c405f319083230ce59e662afb15bf81b3762f6003947bc916a52310fdbd148ecc9e5c45b6a89f529e742b5f6e788bf869a88e8a9bbacc39ce9c17c7d8c8dcf89dd83c177dc5fcc31a3b8082a03e139ee90963b9989c005f23542f42be5f805cebd4edbfd57812684ca0dc4e472dd37bdd90fd0d1bf5f1ec2cc8aa17e7cf55afe81c60de8c10fa839f9ff8c7e8209a4b8cb0baaab367c718a1b5ed840a0697ff8d63d3793a9cffed2094aa5300648e381812163e1033b46325ee94347a36cab23e834431059499dde59c4ea6163d547214873d2385c1eae7e462fa45254482bfa050e4fafeb6360d0b39d25982ebc1ccdf96415d04275fa316d96799018bdcc9587fa598315a5eb6631f0a0e154443fd34a9bec1f71877d1092544e2d439a40614a2b829dd7166900fa9709fb801e1cb4754f382e9e555e9db0d81d52399da05182612225c9981f7ba167bfcfacc400e5519a0cb2520192ee7f371ffb8a7f4fcc5d6ea3412517cbb95f4e8d5e931478d5d52679bae3842c48617b8bdd476fca7e41e987c969bffca860f767cbfff26e4d7afd4ef9ba7c3d09bac3cbefafa0a2894cdaf4193dbcb44c0f69c8d7ac36ff9b1f747fb9c7a1ff93806801f17748d8f7ec18bfc2544ff156706a6563a90dc43db359a868e821c08c3f4e47379f78f117dda7bb5ea6f430444b2ebe3865c3cf49cc0f7ecbb3385780ad305e2a90f663b5e49228cefe8c451f0ef26fc6d4b27e06912b5c0185e404c48c5de61a890bba65c56ffddb1d239b001beb05c04a1629c9a6965ae33e0e658cc144b316e59a52cc8874da08954fba67d35a99ee83aeab70f0163ef0328a37ef7a4a49b41bc5c9c4eb54a304e482cfecd4d1e6c147828a872f536eec88e1b9360b904e692fdbf132cba971d434d8ae039b17726355f6f665072a9343662d5ce679dd74e459bf8c3bc13c651b5976ade0b1b2eddfc0e99f431f88647de943aee99f0395bedfa1f5ace9eb61d73aee26c991555c74deaef6b1f7ccfa6f117302cdd111d8e26903fc5603b1426978905bca8bcbbcc9314431cc238852e1cb188e5ba3137f5ea1e5bca586f393189ba21a60db426054638487e4d758832bfa34cea3f8524a03338fe6564ad43bb55b23c25e8966cf59efd03cf2e9979859f9bb91d12fb04d6a1876103ec7e63636569eef1929e6dce1c2f2684c20ae452c8e8f7117fe4ceab29c4044236b599954962de069d02b3bae084ba90460d764249c61936241230f3a6b97e3d4a2b1e135f2e1e2a3cd058bde773c906681f3c8003993765edba879bc00f65888d629506cdb85990e4e299d11b85aa4edc5ddfeb71cec652d27d1be685f00a5fca1c2c99995a4fd0e381c5228c34887dac35396555b573698352d2293e4a91d48ab8f86542f0e1b73c538edd8d4d751774342bafce5a59a069e57ab6c79e3cd8e971791909e7f649db56beb2b859170cc29f6ad6aba9b45aac8dd43d79d4c8c740d871ae77bfb8b3f1e6dc5e310f7bd99bfe34d23d72bbff19cd0ae5ed2e0f81aaa94e64f4e29ffed0fddf8b32dd7cfdc4e36b1e97ebe2f8c4978117dd836b84cee596d33b8d39e801a6e03cf651a56e55eb75b2f38aaf26cc7c635b4a9c2b16e645eb271482761af5d56e3494095518a6afda52f44587ea3f8801c7168c9f928eb5bfc6d5fe3fb49b96586fd6aac77489f152992e70365135887edb8e7722f903278e2d349ecd93a0f0ea305ead997c54010af527b4edaf89e76858204c48b43744537db3e095ac1bfb790788adb1e14733ec2fc817be495513a2d3798610312a3b85e047383965bc97c377c460926ed170b957ae44d68f3915b1abadd8b4e6ab78bcde848e154d6f01552227693fe8430f7f62c5a7ec96c40f7403ef71d4db14b024cc5b432e63bcd59a9df9314ad1b930d76b167cc7593007f2caa98ea8d46dfe15f4d9b991efadeb9dc8502602b9fa561755778777796e25461474f4b7091c98a7cb642faf98bd397202594e6c59b060cb8ac3cea08916f9ab0fbcf60d42970a133fbce2371989ad561ef73c11629c720888aecc0fbf986a418234daedfd2923869cfc0d77d453e8425f5f490768067a69d8f44ed5f1a5d0e390e9ddebe3a773156a2445df2a80e2a44fcbe953b0d374c55617ea468266a2963917ee353e44dc3abae722a8a22beee5be5924d4ed8f0927f7af0d8b0be3d77e4868cec05d8afe0a52b2fd14b911ff373de03555611be5de1293f7f7999f412a946cb93dc9a03c75c253a75e28ea53ec025064884910405ff226b5e39849378b613b36093443334ae0530cc5a3b0efb9ab23c19b6a73d7d4c09d8d133e7d8229169d19ed42926b048e15303b685f4a847723efce5307506ae43d202fc965c71f5f3068cf1602fec4bf6c63cc7086f584dded38f3d1260328ab2a9edbfbb10bc534a262c1df4732464315e7b5106579a638d4d94842e99fd57926ab344451b7448dfb8a5feeaef1a27e5a6a68cac71405789a3ef6929381c50ab0ab301eb281a9bbdc6b7be166933a9a55579ee119bf126ce4de62bf2f9776692b1e74dd2ba9ca74357c1dd7151e375b957ca02bfbcd07ddf6014b145e94f33207a0ad9ea17a57578a28ea8ca56e6391f228a412941848b3411d9b84fd8c6b3eda11f0b43c8c2666886196b3849520a62b5f1ba0300cae4fc2cea4dba5fc8bf8242a9cffb8619b6684d8a746e330b5594fb3da823fd2a4517fdc01315211cdca3601c60078d44e73e9f8cbe3032c1cc6286c84ec9e006518907b398947d96adb3c34bcfc7779c02e6b950c60d03bf80264bb8e88e74ed4155ba41bbb365f88beca8c612336ac8d1a2d8be364db906a3aa9d644f17dc3b99ddb67e40f4e7a7c654cfaf47fc37224c16ea7818e9ca7c181ece7c5b9cb08a0a0f7edce17536e1be8676517364b5a424747d1db8ce2b5337276a2f3c8c56e0929bd3de424527ef62ba96a6e46fbde5ef1bbe1e5f38774ff1778e6ca2d8045c92341ddd9bd006bc57a7b39ab0ab52b525fa1775cdf603847536182b41ca3224a808a5c4f26bdab8dd0b3b66afe78ae54171e822b2edaaf4f3df539e3aefff09f7b9cd939c32bc1424951474c7ac36a66100abca6a16dc7d42172952ab05364d69ed77141db23621e437b0c04cd232a61a14f9ab07dbc91babee802d76dec3125e4f006008038a4fc968f78f90b0b1065712e48e6ad273bed9dee06f5c06eba24b109fbdeeab54575a85ad99faab99c23ea06ab7ee60e1239e8c8196b7a75485011fa6179a792c552eb20c7e377c5903d4203b9cd164a9ab130d01c767db0f19316218f14c52cb82f5a1eaae7447f0afc04b41c2b9316f4fc51961235365a0157f930b27478754d7eafc3a8047daf2a00a68ebcbe3f513b051ad2191ac4c9c898363e04368b76d7a17271d55fe0c66d9680fca7346444f407224d54e166cc808c4a1869978ac3cde156dea2d7842857472aa48666de318e523571f55ae1930c1ea82ea541a42ed806ae336349673d7acb5f006e25c57144094aa396ac34dad27a246ff37655794889dfe884018fcf8798a9bc974de3b1eefe4c", 0x1000, 0x7, 0x0, 0x2}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x800, r1, &(0x7f0000000040)="b3664034c5c079ed761d8516e2f43576bca707c249e38ac7b7a7af50cac599a698e71e740375d2587cbd313fac2a3e0bc0a104f4ef5597f2d931629c640739a7d86c982c790d925a494c8b91f8a87ec2c5a0b140101f36cf6b978962d08650caf8935cd412ad6c236c7fe950661f0c0fdf081a901841aa491814649d254ecf9653bde1cc86e23a20b08dbc9add452b71482cfd5c1fffc2e55a3ca8d058caf27a89077d43674af709cd6e1d000f0de56cc01f8a85a2", 0xb5, 0x9, 0x0, 0x2}]) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) 00:50:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000000)=0x10000) 00:50:15 executing program 5: r0 = socket(0x26, 0x5, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x4, 0x8, 0x5, 0x8], 0x4, 0x800, 0x0, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00', r0) io_setup(0x6, &(0x7f00000002c0)=0x0) io_submit(r3, 0x1, &(0x7f00000004c0)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000300)={&(0x7f00000002c0)=[0x3882, 0x8, 0x54f10a83, 0x0, 0x6, 0x4], 0x6, 0x80800, 0x0, 0xffffffffffffffff}) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r5, 0x0, 0x0) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r6, 0x0, 0x0) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000027c0)={0x0, 0x10000, 0x10}, 0xc) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r8, 0x0, 0x0) io_submit(r3, 0x9, &(0x7f0000002a00)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)="ea644b2bee3c5fc35ce705a3d6372df067b9038b2d7e1d2ec61f7bc9e044f9c7bc5cef5d320915a617a897319332b7259bdc08a56c11068f4b615c23c97a688f53e009d4c967f8326e93718023c929a29016baa97a5c279eed57c1a29e8236ed8f95e783cdcf09891ac9d84ac99de5b87012717efd91b3a5aa703aabc13bd0eeaba150bc50998f0603e1d4ae552e2d314fe9729855c46fb4cebe4f0778bb6b99beca13ecb60123e3976d7c1e24b3ea3aba0558df6d3f6625edde7ec10d27392f024b8014b5d8e40d3852e29fa7ae8969", 0xd0, 0x5a, 0x0, 0x1, r4}, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x8, 0x6, r1, &(0x7f0000000380)="5f79ccd17dad4099f7b051e05f435872640b4d532b9ea3475402a7e2b547ea929f3d4eddc90073a3ed3c660434065c0af1676d6b03905da9d7c6eb7b7115abbea10443b2ef4555b221f9da2ddbeed8f33525c5aef787e442808d5cd761aaf82226151170f5f8d6130f7f1a95d3f05b189c590d3d7671fc2363a7e95581c35ff6488f6e02211fcb959f284e0e5d492ca5956698940f9740e3f233f7ff258c66d3a15e3cacfd24e098ce760a8b06b3ca02016b0780abdcd96d25789429ab09f79740b5dce2ab3974e6d4e3c3a6f69ba0e92de428a9a9414f8c52f2a79bcd3fc84c68a3bcd758be502b12870eb8276f5e12a5d87e17c59bbd5e4c7ed46cb401b7e92ce7313f5f317bb739b3874e8d2e45ae737bbd4cac3861bb1533afbb556ae039cec8ea252dcdd9d29012fe457a1838362e024d1fc82d4b9f922a9c29601b0c00e129945dd2bc94e8d656e31a419091749ee5fe0a6f4c35b3e52a0e81448386098767ddeb4ad39089ae9294eb22c3061ceca07da1c3d602abdd77774c036661db3b6683b0cd8c2ba59ebfce8843d9840295cac55b91b7064f636f31d7282721766f334b50052109bfe084e69daa96c71294dc2e2a589f749ce86806118fe88879582f9838d0944e72c2eae849f76959ff0ffb2075a0754d619dd606a73d6318be0ee1ce6264af992ef99158cd89abbe8a5a90dcebd9a33e64e1ea6c1bf17a52feb95361e8bc410b5e80b01b4f23b34f3b056f7abe3074d6e93412aff910b06ba041a75cbae393c6afa50255c3e4663fafce6102f7772ca3a5e972871c85ebdecdeb50ce51605dc1c1368704d11df3e6932bf08e4006d5a7944604aafc1ba61cf0ee6ab77bb8b0e52d64360b6ec49df5ea14d5bb0889ee1be48c567449330d56a5593a7e46a13779f0e7437bac5260715242a9d186402b35036b893b409eee972507d87db5a1e76928493e9c0cc6001b569c34e142d8e963894d3c5b4748a2b8ee27a64c24232fb2841b02fdd901eb0024d3656c0fa9ccb8b21aab40690c5760a18e7efe42956c0bec89ece463f06a08ae24a675ddf9a5928c62f1917e5aef7f5fe9963cda10ba3b0ddbec7673cebc7c5369c0d30cc496ae31d715dac6591b4b90f0e15125f7a45aabccf7b8a595b09a98846a5106fb332019a24d9e2303adb3a8538b385ab6c758b62df72bae8be4fd83a56a6794ed1dbc0d3f0bf3b9d2d5dd127b5c2fee71828de047cd53382a6155906cacb764b4196bfa6014f260d9a4d6c3b3fffae8d563c1acf68b9cef626b4384a8a7594674edd60c1a846ddbc75e61527cd706a442d5130c594fa37cd02f62360b06e3ed01d79b4f5258bfe18f4d0aa3be79202c166873121ce1287e0a4ebfa48fa44710fa25da8ffb934f014062c63c8b56153a9cd5725671e9348342905af56c54da90f99cbc6f5bbac30d8b11e177e170f77aff03647210488e3b142101133c17c1957984562475e1fd055b5636d48302f9a4a11309701bbf5ed230b21a5a8b1157f29b4405f782d39ff609ad6fa97952ccb5b5946219abfb1a27cec1380d38307712fef42b39a199121c28dde2b6d7075224d6f87c3cbe5b5b176c2210e282f61a6062486bc1f3f7c663e996019737c9669bf77bc910fdb6d7d6c71854a524b5f672157908aa1e7ea721da41392fd477f8baa435af0d931e558acfaef28c430a170d79ea695a11044cbf23ed2051a1c3819c9de704ff855ec7847e85371e787982aa1a314cff68912b5b8c60f418df0debe9487415c2d3763fa162b1b509e55ddd5665d2d8dedfac29d271dab661cee90a7c7863c405adf7c78a0ea6687dacc2b2cf64628db2af6c90d6decd1029ba893ce4c42c08722773bafff05c7b093af011a3705ac5231c5b296b299053a9d98a53ec5fa7308fe366368f61115b9450ef2fc65b4721c40b3c7974174d2121a4750a87cc3a020725170ce1d9a5304b77ab1417bb842a53529821b532b7b301c4d31b1205bdf438b9ac9d5c13832e850189cf62ce17946b5d9cd9da847ac0a8305d10ad396d2f35a2492c3206d8c5df993c0ce6d86042ef1987d8285facc16ee973f9898f06cbb127643d7720797e8cfd582736b509e1641377bfa0295549ea1e7362570ddbdd438b04808ec7cfe59dbf39545fd71e812f4640520700c30332e0ec01202c79de322d8329f902d410c268b2d70b5313b2165e6cd857d7184926f7cdeec937d775a994d8ea9a259e729fce029937099fbc04067675fa62b7990760502aae78e3b0370c51de6bfc8485bffeb31a4d881b168c4aa774c2a142893c0447692ec9bfba320c99788d9619615e39650a840b235e78e8231d68380f79b34e714fb52bc4f54513b16a51674d123f121bc6b7560bb4760b58a2a609822ca8d7ce3e84f730313f6778c4a89cbc88f8d8a76f0ea265a6d0cfb566550fe88f9ce6ec61e2df549d004a749e444b708e436404d35bd1fbc8bea9eec7260d2110b55664f41eb17f1adf1beb4e86b97efa6ea014e577d01686fcc132265bcf00ffba15b8f3f994862c144e9cca21b6f250473df8f97a0a96d3ef377a424de72225b185e94e75f25813387525f057dc0f37c2a0797809fb84d7dd3bbf3477fb1ab751acb9ebe1ac1f618f7b4618d7ab18c17f643ea6908051c190e336235046b2e653a9083092b04c21c4831132826809bf36ffb716cd9157726a9e9d70575ba6421be77549cfb1149686eca2220ec4b419b4a36014c00ff0e812a13c1c94e1bbf6ebc96608255f879a98dd42e703b865167c97079499cc18f43c7ce0ecdcf6bedd2c6ee22e3c49a46ccce7db9640fa40340647fa041c6609a8f0996c29d1fcfe7153178016d818c533816a464adaa93ca7113f25c6c23646eb777bf4c5d30179262bcbb1c21fe4ff4c2846ee642c3494df99f6219ecb59d775459c26c42acd77603aba36818881d547fb5474f162c665af230aac20047ed4bd27b034c61aac26fa553503d085e5d8c762e2bc4dfb46e0b8778b0119c2002d4fa8d0cd4e189baf4aa26b655ed30a5e83ee130d2f262456754e06811384a6636380305c69099bb130b604ee804ea407000642893796f6cd45101e80ac536e6d199dfd619d85c55ebb7a04ce0e8ca3c027f5637fa81818677af59fe3b391417513e4405104884642a21ac401365e59864a01d6f56e82f5581c169178673a5fa81d54ef0443cf4f73f3837797af2fe15c4ebba103bd911f0e3d846fdd376ce3cd3c3fda0ced545dd6e57fe07daabdf3678652f03f9d628f8972fed23bc064848bd01bddac437415c331c68558037d20f7d8c0b93b6b109a5cbac43e8d9253834993f1e91b9aff84d61b0587ffcbd18398b3d812ffbb7f98a6949a6a1b7aa19c6bd5899408171dfc459acd2f7efaae492c429d449bef040becf6879a65e06969dd4eba69555a17484a08fb3754f606dcb99bd9a521b34618d274d1307cf87bd27ce43bc5760033b1ad1ef2ca09625872d0fd94e41539499d87dd1fb8ab5e8ede64500b2b87d0eecbfebb24fdd07664de633997f672d46d920578a1d2dbcfc8b5cbf0e89e474dc9283873038cdb47184ff52e09f712120883692797e38c57bf1fc96ff0f7be979f4c16fa06eb780296f47d661982c210a5ba73537d86741776d5e7a40333dc1b93206db6e0e101770908f157b7f674ed3db44ac978c08a746a86c8e7712ce30d670e0cb0d1445465aa19b7cbfe3734f6443c2be85a2b4dc102186f102fcdd7d2bcf9bed1604c2c3a5fa1e8941b77f9354bb1dcdf91eece4a5485bf72dec409c5bd7b6c26b0be1ced623fb1d9a22f5ab8207df86d13a8585975da99e04c0e6b3b606c1228a9d40002dd549adec7f7137247136924a9f3e3cc6386c178ce61322ed4f9e8294985177e69ed625364195badf444404cc1a511541cc842e36af35f7c6f1fc2bc7c90522973cfb6d13372d6dd43966d499284392eb68668922c6a9598d8673ee32c66f119fa7f47bfd370a0d6b007c70b9aea9f09440c0762a76a864b56e75c8e187ebdd371fd1fe97af9a15e11eb3c844859483bd7b1254647bc3a433cb1a8cd410f70b956c7d5848975e9742c764c911faf7cc1497855f7a60b2589531b21aac8d8d60ab46a9ec1006f6a3962466bbda49b0c90beea710372c8ba6d4a0ee2a264e9f24c6a4b5d7f2c19301a60193631643e506f71acd3a2c3bec95a3cf798fef412732add0e8e71f24bc9ebd30700ad93c44ea19e492a2372cf0f306e8dae375428ee92168fc85fbd6950373ac1f070c3ae6581e7463c1dbcb97372f63f4d3c84169c1730d6641b888ca7a595429394ecf988cefcf0b4f297a972098ef1b560149ce692a18684fc7642a3df355f445d9cd7c580f75fd053ea5a408ea2aec2eb086a6103e8a7469e591a3ff3dd5c60fe60f34d85893dee0888c1466b874a5f3f1024a1618bcce02f3e5acf42c7a6d940b1cd662fd92036c57c470c89c14270527c97b213b5c7df6e79681bca43c76e9e313df04ddf9c0ea1f4dd8bfe5acffd4c9ea5131699b04228fae7b5f82295d85b62ee5e5cd33333cfab0f2697286dca0876b9a4fb882978d1daf7b40d9668e0f32a41d376424c1fbd3fca1e85e492d960f9bffead4287de459b6b055be24b6c3f2622724217d502a723c72f0db3a6e7a02ee09cc7c09920de4c177294efefac60e4dc6f12f2c9b7b029f4c80712a76b3c68edfb662397ce7beaab1cb91df8155f53f769491863ff525ea97078d81e888ee3b4552e6d5ab2346c450835d3e3fb84911abe7ecc2a8ab192b896ae12a019dd8fb31dc154400f217a5f9f8a01f593f1c3495357e8f35f0c99d3f2a7a9058a05a6a3e661af20df09361c1ebd90884d0b3d1ca1f620bd2986d8ffb372b29f56861dee11614aff86899a963c9ce9965345a5e7e1ebc7bff68ae5342af2a9ca621a6bd3a8b424a8b7bd449584530e75fee9b7f37bed74dd201edcff810728b812a9cb004c88e0e00d1f2ca90480cc4f4f7dfc0650bd98b48b500e55d9506ac5edd029186edd8e75552ec153e28f27e9d84cdf7f4f0d74943be39d1671ae8b88eda17357064d20803ba9fcf3e09b0f1255fe01b78f9aaf4dba404bfadb8a46cb2f6a87428a7fd9e0c2bdbcafe0ab39c88e4c3d48353d75a9776feee0b8ff74211f7f9a2e31ef543046133d395e2bf1a53405d6178219b10832a6caec692e7bb755a78daadbf4de6df0d64e3db22807ee6326dc6b23dec18074c96476aac16b537456769e20899d675c82a018f391cf139eb67a6a749a9e38070f4be101c3e649d5646946496cb8a8ee34e4b477f198830b13e7d10381d55a6e3305511f45957fc77b80690631b4534b9987f8cac4cf975644e6bb4d2b25ef8202fdb7a75e50c99ced230f1ce96ddbdc8637c34efbe5432050bf87754111c245003de8eb0afcf2f24e06837ad836ec6516db512307166c7b17e347ce49993f3d7a741a79c42de8724fbeff65d2218d9355ac5056bed5b20b558cfa85a155db88e685ebbd93522169bc2cd910f6d69588c4866074a7ee2181035c0a4023b90be07008054170d35ce29df3d27da5b07f831c51e7a686279116a99ff6f3f457ddbf4e7fbfb58a46907d46db329a913874b4e10e6cab7ea466d70670351cecb42818ee3b37c60632e8f12d6a972cc8daad59816eeb6c03b97a3a99aebc9d316017b48708d75c21f72289b1b7ce33b2a2b464a54f230eb0cee38a0597216026efded924993b6a7d64251e7433f81d972aab791d98395491f4a30f41d505fae4a96466c2bb62b5f8c5485d8b23", 0x1000, 0x2, 0x0, 0x1, r5}, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x2, r0, &(0x7f00000013c0)="22812f46300a6f6e692ab429af6b9db6b51564b635264fd3ca411fa022d3544b710482131491d98bc658fe4ca8e965d5b4034d0e7e736fa2031c2689cca55d844d028aa1f41ffd86a017c94195765dcc8f1ef2408f7956a18e3f25ed781af246ce623037abf87c28b255e641096c1ff273b219baf73ca609757b323dafd04abe4f81f20bd50cd8d697ff4b93a29322c14c9f64ce28a0b7db3a99276cf2c02e700b24911a837084e276b3a63a88e29f71e77f05cd867b2492571de94d6112359e35031622a6d5d569d232dacf2cfdbb8d607072596406f084cd1d2341d47d02b097756ea3ea36055322f5da9cce2d69991ad148303607c7a6944c8ab853a0e6", 0xff, 0x0, 0x0, 0x0, r6}, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x8, 0x7, r1, &(0x7f0000001500)="ce4532fb7d04dc30d0c79f5d817798987862575d9f25f734d2f95b7a6158f5d0a589535618a123602f2b4f38b1a0c67d0be29795d25688ceac4240c556ea27491063b9e739d83b11a042972082d4e61211f1285ff435c73a83fe3b79160b1f003b3c7f5224f5c8d7650c92dde895e52ae3f9a08a365e23e70011ba2ba2ac5cf971044690885587d10d3e2ca48eb1429df8b0683b24", 0x95, 0xbb8, 0x0, 0x2, r1}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x5, 0xc000, r1, &(0x7f0000001600)="5e8497f5dda4e6df56ba8a79fa825b027bf410c6d0", 0x15, 0x800, 0x0, 0x2, r1}, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x6, 0x3f, r1, &(0x7f0000001680)="9fd0053678e3000ed1bccce7d3c25cd53cf4be61f04a0f45f02fed5a42d1f3d79a5c2fbd9a806e1532ee2cff3cf28b5325f9b3a279d9c3ab58d4a18404663bc94d3e6941ac237c5285cd95d8107ed3549feefd96f99dde20e3419e3437d594c334086ab6b720429030da174954598a6a44f30d40e7efef107a175dcefccd94e7a99ff95777aaf5b56c039e6267f0a28e1769a1c8e95e54f98ad6c9854ea03feabbd76f99c537d6cc0676e091", 0xac}, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x5, 0x72, r0, &(0x7f0000001780)="de993d5ff03533db83f849d7cdfe43d9f3b27f048f829d524a0873f00ceb396980f8f5edc823b4ebb70e90b9fb74b5b0b2c5c78fe3d5192164f83658456df755a412461164012df922c2eaf3bff05073c9752a7e941c2c3a971c65baa960a38b464334d42bdea3fcfd60733d884e970f4dd93b2b20019c09e31ae4399961e6e78c5100aa2ec4af60243dce10483d103a2c808ca3a64d18869a6b01732a6ea5bf41c216cdd04ef71b91a790aeebf23becaa3c6f3f24fe14bd9a0bae63481e1b60b2c9fe947ad9777e3f7250df465638f6315a888ab0010548ffa27904faff9791aa589e6b61b230121acca56100bbd5077f8cebb0865fd4b8ae0b3344d98d609e3c6571105323a2b3ec00431f950d0496bd804599586139796c0b4dd0a8db3d6f7e8164c2a18832058d6ed71ccacb8116a3ad769d318a389d86fa1e9f80fa565729717bd8fe1e9fb5b6686c27c321dcc41e4c0c364dd3ff990e804682e99c9537521f2fb4f88f9f883c131176807aa2df60fceb86c0969b2fe25975f456b107d0366a6fab3f1076ba2dbf0b0cfe8ea7861930ff5f47db6380665ab5b110560ecd0714534eff7b890d44fc5c4c82705ed5ad9b05e8c0a7e8534a4f42101c00252919aa7861ca78240d713d858827f377ef0137ce64cf4327b5e7801f735c98db058c0a6b075d04a0f346959c17e21ae3d830df90730025e7397dd183c5a391ebaf1fc9e1443bf1a3c7c6eef22234ea0777fc0b623fa53acd41ac4477ed144b7a083420e7363be778a21b35f4ac24a265133903d005018c43097527340ff297d2f8f735339a346ae61fdb02fc47f28c59d233559bbb811180699ab2157a1a9fb4ba5e5babfc6b80af8292575814812c7688e9d223bf3795e1e990b0041d61b9e422d856e9b4a97481523d731270690b61ba95fdfa52815831dab26318517af6e34c985f42646174d48542514e74a260cad8423193e76b2cb62129aab605ad26fca518e27030c764a3e6b4bd8ccb5fb410720354d599636681082855761eea0ddb034002e1fd287fa44bf2b59167b16cd3088518ae1255768a3b5f4709c78688da249b46ac60c2f74078e00d806eb8df7d96ec8f0905434faf3ed374523a414f4aba41fa9fdd191cb80cb4fc23be434c41ac63bdaa9837412f77459539efacbb34106cd76e31b7329e5ed51a8835cbc79f5285e3e6baf90823952b0e47d5d4532a9638a566eedf24c46d69ddd2ab871f36723ba4f5045ea5f91b8edf2801efbe9cf40a4e95c547699a6e5868cccfe9e3d087cf4ef31b3fe211084c5c13936abf628b2b11d6f870200de8431f8bdc7356bb0199a5968f37600ee30689d3371137971cf772e68b770ab5f3343b20377f4f065da2046830c76293863f29b2e27c678546dd72ff15a9da20afc7336275ac9293f434406128d88c000aa5a867a1bec03ada1cd867ae8edf83cf38bb938b37e55e88c0a02e6c08aa4a8ac8221e9d6fdd09964165f1d47d685d207b58fd7a2eb83e4cf10f5f6f2040d2a08dd3707f571f52cdb6cec5089cd834760de2ac1c0a909464effd4b6e569e6b1c3059e02bc6b677bf1c662721ab9cd0e9831e317bc0dcca27a19ae50c29ac6671b1e1cae6f602276b9222da31ebd7481550838c4ca354d2d5f7da5397518b7310968d78bf66bbdcc8bd02e828862602ed0a48a3061fc49196e1c7cd5809f189a79b5999a57c2710195d44a10110e6e2a03b5f9e546487c081ee1a311d2058f445a3395981f16471deb38bb911a448b4d0fa529a1beede211a44d7c5816ddbb5d312e084dc6c8fdf2c5476a5c39dad12435bf41d090288987c0bafc0d2da4400ad79efc141b2338a776a30d1f5d0ab90ff4854ed7e527f500cea17fe543aff708576f276e78709bc7f4ed20c87eec58bc5551e3a22ec2a27d7e564e11a7e271494bd16a933a5e5b42fab9b5d0d6596174c2ab0c8990b444d634e256c6b715adaa35dd65973ca0b960c214177fe28e1b91a6ed59f0d3337ae8a283dbb11721b4f8daa8a723808d8653fac650b0bc9efe9492b1ec24386060e61aba3bde230a9bb2efc521e77594a5aca3b47b5ac7cce5ef3846d0421c4b29a4bbd534900a70902718063608d13007ccbcf83e07886bbc74dae70084265c2ec402da7a7f9f4b650012c0de505da516a4d2c1ad035a17bc3f9f29dbcf732279178d1eb06dc23ac9119cc2f2b2f4199a58feef23a37dc903835e899274190b8912c7cd26198586432cf28fb376ae6d7c62d7fea2ca72f5bae38b9d96723791bfef0c0b0fbe514eed0316dbcc0f9e2260544af4c136ff902f74d4f51a2e018036d75cfda0865b7b021e06f484d377714da8ec83ffaead3cf7b56fc5b50872c0957881b80b0983efb8247eddf54f62d85046559ee4657eaa7915c6f57a67dc89c3c543cf8d361aa350c1aa20c4a89f9fec52ac8d3c5697f00923f4c2ecdde542471fc642153de58e33f10d44f54fb23ec1d2d6e978434d7ef1f52f40cb004e2e5d673a6231b3104facb5dda262f6ffe418aa94316cf2d1ff7a45b4acf1404c96ce74b14f973d9262b235e528c43381f4340efbd73ec16c3064ccc786a8390b7011b93aa200f5b90d1d5db6e411b18a5029745b835e406e10c342d22c316254807f20b05446b9a83e42fc1183eb5d3b3584853676573999226312c258bc6c2827ba211f3701fedb4f9af703c10925514a37ad7a6a1d0d91148af6a355dc7a0b7c720c5a5c69434ea4355f2487342d891e888a65b28089e5ecac0d86628014121545ceaca3a08c47fff3b4e73188a4b627dcbe8f0990539f8c28236ca6aa555cd46611450343e37c359a4f015a6a198eaeb30933ddc1f7cc012fdade5745d8732d176466a29a9f74f267cc9dd6745b8dc472483d9b12fe421ed43f67c9d69b6750ca2354c00f900d6da25a0ad68476d4e24362393caa5f0a7851fa8cc57ad08eaba8ffe4206739420c577cc30d8f8979133cdeb178a999516571e844b768480da9142c5ec5f2ed9bd320e613b07c8f177b3551e26d57a0d1647dd215fd436e8fb44d0193e6e4297452440fe5b51bb075c270a91032ea7fc7eec2f970a6351230ea5d0f7aa0739283d4417d8656cc7ad777ef59fb0d16ec390997c0eccaf96bcf48fd94857570d1d8d2efb2e952622e36727980c37dda902c6764c8ba016f9a24fcff39bc2f9ffbde919a2f17f18a21c69a8d52a534a1e12063fafa04b662ecda141734b14ed755d784359ea8c3a6b8a0c3736d034b081949ee183ec2083e40e54189b607bad13da1a2d07e502c62663b43b376a0812697801691972ce7b479c91c0219b44e7a9fed3e796f3f72052d0f408e7fe96c73a4b833f186cd8e0dcda7d67a7730f32bb9d8fe2b4f8aa7ae682c2653a86dcbc8d4dd0618e58314f0b925d5efe6a1799afa03939a530aea20d552c3b348e8c2b85059d91f1b869dfe1720977bbb5b2128a37cd54c89dd9257cf725a5ea882c8f0d1b357271399b7c9210b56989fae31c6cf1a7bf5a944c818349153ce341aecbf0a044bf5a20b95be8a45f0a388c7d56ca5efb76e7889c336b0d45caa7993c92d210059983d84e46b859e48a6d7af1e77f08565b32f7148e3ebfb62ae8cf741d8cd328381bbf138e7b8dde6921000a3d750193da30f705aacf478c1f018cfa81e60c9d9c63d24fa81bf4aa1650889f47492dd1a6592f186f143187c1535e7863646a10d0957c6854a784a26b4e52273fbe8a710009f6d31e98b821a2ea80253f17dc8bd3d9319614315b8f659a8786d5bd6428f5013bc179bc5ab794829235bc89562658e272875babf710bc3a779400bfa6cb145e2191617672a5d663d33f4ba8a08febd813145da65688676bd7e85b69ca4d43d4ac41646d09c30b87afd05d29823885e1b969826a7e8ee65521aff06236c584bdb571746244cc699c3bba2452494a2a0ef1ecee5679b316c152a076ba10551d71e94415f330d8d9291d4c60aa10a1d26afea7aa4a324f8f724026823a1a022366b0e53571e3b4777658ddb43f3c77df65d00efe4d1f177fbbc385f93ed025408ee2ebf1c5859c7f40a3d3bd594f6d8147a596463db573fb0d674cedc1dcad6abb22b7d3dfb4bcd93b8303a9d45d6cf5ec2979b82cedd1bc03662d391a320a93b8dcf7bd78e597c7d0a399f04dbecd4267cfb709154e1bd82fc679debb5d3ebd4cd992da2ca000f7bad03ece4b42e6e48137026d3cf3d94c4a7206fbe8388344e4838efae068bbc3ee479476a9392cdb9b05fc4df7cb68c1759f497ffe63bbdeb58f5c76d897bac374e24c35f600c8b63c279553e76bbc881e4e4e445c1f9d12c8e71668e57b1f9e9eeee2ae91ef82c6570d65d725a99961d40d39b85152cffc66b6802bf45f6f32d1200b17237ed95c44200bcedad0edec04f3afa8123bb25f680203790c93e9bf18f856570a4469a918dc29a44ba90f0afa318b53c6afaba0795b33d405f3e05cca8285d8c1e914c829ceb03360be1eddda46c078aa67379cedf1d44900b80dd249fde71445b7cf6e65088413b122fbe7506feae21e1f642772803fcb3b9d0f6e37a72add49cb2dd33ab42e3a5fce0b4e49e210fd59bc43efda55559b265d95c4cd6fb11ed8730b5c757a97bf566fce564a751d51dad12f2d175d7fb8a8af60ea53ab5bd2d525bb9d513dea086ee853f43a08e20cdbc21526d8ce890bc58d421f5b5e9af6e5ec0a7526dc45bcbe6ee38b7687494b79df3357739872d3e0e8b42111a46b633a8ad7b1b6d039ebaa8346c45380116e4de8039712b6956e13a63a8928bf1801f25d66c05054f059f3c0a9ab11b86e11675f61db925df21dd424833928469136636781159f21067e075483529cf104bff2c30d7b790f04221614359536b8faffb522479d6dfbf021681737c896cef726e46af85d5151fa49994ea23c8b232d44328ca0abcc08c67d81af981dd68395ecb9f736e9f5f1880def1ba847d14d8be45ac5b22f19540e8288f81a982afaa8cb51e206c4386c370fa5ed379ef9e4656a10a71496fdce669407c38890b1cd8a173014e30877e31716a86edf0dc579d72d4fc1a6965dda3cc5ff9fda8c916259822f6830eef8b5d625257a31d1d30afdf284a5bacf5c6fe5699f49aa29c05a236ac7f6698d40124611826446baa6a0b5076e159e40bfa7097cdacf2e59d8760375208f702ea766bcd6d5135e4899f3670000ea26b8e8f83417c66e85574662ffe3893364e8cc1f4cfade76865473a808273ecc1f519b84dedef303013988e5610c3a6781af9f7075fcb452d650c0ec25026a4e14103a7af546f3a8599c6e1777f3f3dd2c1a0700ddcc70610b639f5b5c56d6cebf5fb7a624e9cb0ef9828d92c6364c9262a021ed9d0e3a95cb6396120eed8320506cccbd80e932a1d5870ee4c6848974ce86173d9aa2311632bf37dcaad3e25de81dbca51e76e5b3bd29efd57630ea92b081ebb37563229564a7fb438131f63ac4a66990752c95f4d17c46f05cd8c3b3d3d22cdc288d19ff34fed51c2df9908294bbca2b1bb4fad55981c288ac91c9843b760e48b3cf091cee8ab7726de9612b04960bec237b44b89ed5cfe33fe0e034429a515acc15007a8f96fbb2c63a6e61e41ab9050af67d243bdad58517550f4264310830f3f1842d8d29f8a1e65369a027d1048fca68bc5efde8082ffd8d62cc29a76e2c97ca6a76e281e3ff4dda5b75f3cb3b0d7ee520f4b4a854a41b4f19e349396fbbc83bfe01a32f3a87917b59942fcf9c110f0625725e62318e39f3587b7ea1bec7061938d4dd61aa3b", 0x1000, 0x20000000, 0x0, 0x1}, &(0x7f0000002880)={0x0, 0x0, 0x0, 0x6, 0xed2b, r7, &(0x7f0000002800)="335d0d738b0c9fe242c323dae31efa99b5fb52701a99514a0db26ee3a880ed11f49d52921afd4ce11249f6758a71dfcdd5c3859b039f0a37c46b5eaba44ff11f1c8d31d8ee252dff178d5bc4dee27a8b8c866aae8223d911adcdc0b38765a0", 0x5f, 0x1, 0x0, 0x2, r8}, &(0x7f00000029c0)={0x0, 0x0, 0x0, 0x7, 0x1, r1, &(0x7f00000028c0)="9f7b26219bd2329b930bd8ec46d33f3b20236ec7253f76db793e4f9a92302b50ccab380a4de4bcbbcea5321fe38bd04450dfd6ac36592e0d31d716f07d1777e9f8374e2a26170717dd83da4a6079fdaa3aef1c891ea3434fc27e00d27031ca30e403d1d73cd9e509c4abf6e5c8eec13b804a5d7cf67cb59c2812b7683ecdf8372e9d0a4bf18af3083c77ae72695a57de43d90b75b96281365408ad2cbaebcfe6a47f9be5e06168eb038ad22aa511d829e47fe558992922dca1bb6f5418e4ca1f0cf5f77e53298659e9f3d5e49a4ff044b82b0e87a70058d5", 0xd8, 0x1ff, 0x0, 0x1, r1}]) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x8, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x48d1}, 0x0) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x1c, 0x0, &(0x7f0000000000)=[@clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:15 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x138, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080)={0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f00000000c0)=[@free_buffer], 0x0, 0x0, 0x0}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) openat$cgroup_ro(r2, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) 00:50:15 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200, 0x0) mmap$perf(&(0x7f0000fec000/0x11000)=nil, 0x11000, 0x100000a, 0x80010, r0, 0xffffffff00000000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x40) 00:50:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x1c, 0x0, &(0x7f0000000000)=[@clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x138, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r2, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8080) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x10044005) 00:50:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x1c, 0x0, &(0x7f0000000000)=[@clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 00:50:16 executing program 5: socket(0x25, 0x5, 0x9) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="b80000000a06010100000000002b7246fe0000000500000a0c00078001be40783a8521791d06001d40000400000900020073797a31000000003000078008000a40ffffffff0c00194000000000000010001800018014000240ff010000000000000000000000000001050001000700000054000880100007800900130073797a30000000000c000780060004404e2200001c0007801800168014000240ff0200000000000000000000000000010c00078006001d40000200000c00078006001d407f93adf75d8811428b81e95a9264932c2364f1a9d810344e7c50b32f183a7350f243e6600adfb32b58ebee26e600046013c4d29e4d210918421ec01a905656c5e81e8e17914bb6752c5b62878ec24dada5e7dfcb01a5cedea243543ce43a53a80009390767f5205f1b3a527891256a83cf7195f9e46aebbe0a126bf52a10df9bf717f7865627198e7955f030e452ad0f408c90ddbe2358f970e4f9135c4e6cb2e763f5ba45f1836f87ad4e8096c2724123be09f850099f6f9b44a1009a612e4046c5ef5156d86569639f61d466e1c9a16f559311f8f67a572faf53e542b7d07c6a2dcdfec76954ee1722b95d7c686ed0925a88f3319f78435930e56eb970b382515422e6acd08c34e1e1942197a5115ed744c8"], 0xb8}, 0x1, 0x0, 0x0, 0x2004c044}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, 0x0, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffff0d6}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xcf}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 505.556931] binder: 2604:2607 ioctl c018620c 20000080 returned -22 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x8c4}, 0x20000881) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 5: getitimer(0x0, &(0x7f0000000080)) socket(0x26, 0x5, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x6c, 0x0, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x6c}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x22}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x52}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x4040040) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) getitimer(0x1, &(0x7f00000000c0)) getpeername$l2tp(r1, &(0x7f0000000040)={0x2, 0x0, @dev}, &(0x7f0000000100)=0x10) 00:50:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x24, 0x0, &(0x7f0000000000)=[@decrefs, @clear_death, @dead_binder_done], 0x4, 0x0, 0x0}) [ 505.620935] binder: 2604:2622 ioctl c018620c 20000080 returned -22 00:50:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x424000, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfffffffffffffffc) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000000)) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000080)={0x5, 0x0, {0x53, 0x76, 0xc952, {0x2, 0x8}, {0x7f, 0x9}, @cond=[{0xff, 0x1, 0x1000, 0x4, 0x1000, 0x20}, {0x2, 0x5, 0xffff, 0x3, 0x22, 0xffff}]}, {0x56, 0x2, 0x7fff, {0x1}, {0x7, 0x200}, @period={0x5c, 0x8001, 0x0, 0x8, 0x3, {0xc497, 0x2, 0x4, 0x7}, 0x3, &(0x7f0000000040)=[0x5, 0x6, 0x401]}}}) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x4, 0x7, 0x88, 0x8000], 0x4, 0x0, 0x0, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000fffffe00"], 0x8c, 0x0, &(0x7f00000000c0)="91448710fb8821876a935c98eb9a61067c4069542b770fb674b6de89eeb8b13fb479be98a8799afa3cb8b538c4e9623d5e9e29c89f8345c6c0085b7aec2664e8f104dc5b25c9a1913f6472c335640b3554c34a36c95f60b056d62240e49d628374d528d74254bb9b74a161c5543bb196083ce909326511accf4cc42c661bd76b01c6bc91c537ef00d6e78524"}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 5: sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf58e0aa21dce30d0}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008}, 0xb4c36cda4635c232) socket(0x26, 0x5, 0x0) 00:50:16 executing program 3: socket(0x25, 0x5, 0x9) [ 505.734976] binder: 2630:2641 ioctl c0306201 20000800 returned -14 00:50:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) io_submit(0x0, 0x3, &(0x7f0000000900)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x8, 0x9b0, r0, &(0x7f0000000000)="2b6856146f6d85537ede2768a3a7746aa1fd1c7b59ac594cbac0b0e521579901b94e229fda648da61d84bf8813fb96f1976822182bd370c402f0ac1b6a4b2f50a94019a5468e9dccebb4601f2b1c2781401445619ea9af9895d1cefee412277fdeeb8aac3cff82139cbfc77d7cc840473baecf8bb263aa7b308354caac81d3d787a931600ad189ea46c7eb3ed9abd6674d92a9f4b6d8abdd89b2ed2c2f355e04e99c3d44434c24d7992384bb3251fe5be4d7ee05fc9eaf3240cfe6bad9b4d1c699e25d51b15985990b8b187edf2ba1a5e7d19294e88c6d211b8dd9e8353957de10749650a7f0a12cae", 0xe9, 0x7, 0x0, 0x3, r1}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x7, 0x3520, r2, &(0x7f0000000140)="f80ee906b863d4117594a8b78257aefde2d200c00fd065263dca479755c56872e1d7c5c51e4cbebb9b8423eb40419ca5dd4379d8f8ae721dc32bf73ed4f3b5f3b4167d30c09bff02b3f7156909e1ff1bf8", 0x51, 0x0, 0x0, 0x0, r3}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x9822, 0xffffffffffffffff, &(0x7f0000000200)="89c0c6ccfaf00cb550959c539f670515e6abd8daaef993ec16b1dc8b50dd349d4a50e63b51ba77ed42021be79cc2f2ae6286264d3d47030dc2e87767ccaf89ae1398ee9efedb10d53b8f64c3036a7b27e077b70d04f89246ca79", 0x5a, 0x1, 0x0, 0x2}]) io_setup(0xffffffff, &(0x7f0000000380)=0x0) r5 = openat$cgroup_ro(r1, &(0x7f0000000500)='cpuacct.usage_percpu\x00', 0x0, 0x0) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000840)='/dev/dlm-monitor\x00', 0x10000, 0x0) io_submit(r4, 0x5, &(0x7f00000008c0)=[&(0x7f0000000400)={0x0, 0x0, 0x0, 0x2, 0xfffb, r2, &(0x7f00000003c0)="b2d60bcc0eda0f3808ac14519d3128ee14993c4cd1add1b6459c", 0x1a, 0x8, 0x0, 0x1}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x7, 0x7, r0, &(0x7f0000000440)="80d6e1d74aaf6f86a12a09c4cbb6a22c7cd1221dbbf6cb4063ce1acf8ba29465e8c0621759afdafe372e2eab68c12fcdcad68e576f350ba39c643791045c7f1d2bd1a6e7878c4e2c6d1c3812793af2d8f24443d85fc93544b865f7aa09f8e4601a439c6e5efc4f1e1052787e1056e65774dd0d553112748e86d7cf18d6a29949d5b79207078bc081b8ecab06e66e8da0d0ab54107049d02e4ac321", 0x9b, 0x7, 0x0, 0x2, r5}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000580)="ea92b22461e4c1c948ea11f41156e9dd01e9a2c09b91621735c66c7d2ec6689c0d7c85a0e4aedabb2ff4a6eea9dad395fa148fa93e995cde0b24e6205cf9d0b0169331c5b28adc33cdc4958271bb4b79c1", 0x51, 0x0, 0x0, 0x2, r1}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x8, 0x6000, r0, &(0x7f0000000680)="72b43cf9f230dc13a55cb618aaf65811a412d6ae1ffe5abeea32c796aa94417e2023e55f8dd28678a4ced8c1456701b35fdd5abe1d61ae7f4eda7358544df18b67d99916ac236ecd1a0b82a710e2263fd42dbc4d722484b126f41d3c9c0c09cae0a331bf74db2165ccfeb34cec15e78513c3d5a2568caad19554b7a63a93da41af0d73fc0f7f3d200bb6c3df76e0aef63279bc68cfad56e225f9efda69cddb9c8b10068d299801ef40286d6fd05cc6dcb13cd7d0eacc9c05711d22e12bfd8e670019cd8f21001b1fcdea760480c30046713b689ca0e699a23a2d7b6c321e5b", 0xdf, 0xd, 0x0, 0x5, r1}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x7, 0x3, r1, &(0x7f00000007c0)="8065a65a6e272b40722ff6e031099aa14d38d49e054ad6c512db5ef5a3349a9918251381d03e0271c0a7ddc4c6d9fdb57290827c9df4290866e082b2c53c4f", 0x3f, 0x9, 0x0, 0x2, r6}]) syz_open_dev$dri(&(0x7f0000000340)='/dev/dri/card#\x00', 0x3, 0x400001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, r9, 0x123, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_CCA_OPT={0x8, 0xd, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_CCA_OPT={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004080}, 0x8850) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012dbd7000fedbdf251600000008000300", @ANYRES32=r5, @ANYBLOB="08000300", @ANYRES32=r8, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="8e9a3242", @ANYRES32=r3, @ANYBLOB="0c00060000000000000000000c00060002000000020000000c0006000200000000000000"], 0x60}, 0x1, 0x0, 0x0, 0x8044}, 0x20000004) 00:50:16 executing program 3: socket(0x25, 0x5, 0x9) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={0x1}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1000, 0x2}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x1f) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000000100)={{@my=0x0, 0x7}, @any, 0x4, 0xce2, 0x7fffffff, 0x3a, 0x800, 0x1, 0x18000}) socketpair(0x25, 0xa, 0x6, &(0x7f0000000080)={0xffffffffffffffff}) getpeername$l2tp(r2, &(0x7f0000000180)={0x2, 0x0, @private}, &(0x7f00000000c0)=0xba) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 5: ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x9, 0x6, 0x4], 0x3}) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x8000, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000100)={0x0, r1}) socket(0x26, 0x5, 0x0) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00', r1) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r3, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, [], 0x1b}}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d4}, 0x4000010) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x0, 0x4) 00:50:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000400)={0x73622a85, 0x100a, 0x3}) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm-monitor\x00', 0x101, 0x0) openat$cgroup(r2, &(0x7f00000003c0)='syz0\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0x44, 0x0, &(0x7f0000000300)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xb, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/138, 0x8a, 0x1, 0x32}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/139, 0x8b, 0x1, 0x1e}}, &(0x7f0000000040)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000080)) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x3) 00:50:16 executing program 3: socket(0x25, 0x5, 0x9) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x8000) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x155f2537}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040000) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000100)='syz0\x00') 00:50:16 executing program 3: socket(0x0, 0x5, 0x9) 00:50:16 executing program 5: r0 = socket(0x28, 0x2924b67cee1ad970, 0x8001) bind$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @loopback, 0x2}, 0x10) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x620400, 0x0) connect$l2tp(r1, &(0x7f0000000040)={0x2, 0x0, @rand_addr=0x64010100, 0x4}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000000)=0x10000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 506.034474] binder: 2671:2682 ioctl 4018620d 20000400 returned -22 [ 506.063712] binder: 2671:2682 ioctl 4018620d 20000400 returned -22 00:50:16 executing program 5: r0 = socket(0x26, 0x5, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000300)={&(0x7f0000000280)=[0x7], 0x1, 0x800}) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x3, 0x3, 0x4}}, 0x2e) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) r7 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r8, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x30, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0xffffffd2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x30}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, r9, 0x8, 0x70bd2a, 0x25dfdbfe}, 0x14}}, 0x40805) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000001680)={0x8, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0463044000000000205a7d432c0cc7fb5eeced5722f17f4393ccc705e352a6edcd68db7a0f1658d7f7d9005c36bd2c9bc32a2a5d8fef5ce334dc62c162b95baa0ea881a26c22240115abf00e817ec6ea3dc4e61038e5eece67a5f53a3c53ac108a490265c64eb8c109351a4f066e6c8220c7c7fda23b05"], 0x0, 0x0, 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x40001) 00:50:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:16 executing program 3: socket(0x0, 0x5, 0x9) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00', 0xffffffffffffffff) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r1, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x24004080) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00', 0xffffffffffffffff) getsockname$l2tp(r2, &(0x7f0000000280)={0x2, 0x0, @broadcast}, &(0x7f00000002c0)=0x10) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, r3, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x34044080}, 0x44089) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$l2tp6(0xa, 0x2, 0x73) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0xc000, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000020301000700000108000440000000020000000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x6000001) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 506.177315] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 00:50:16 executing program 2: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x0, 0x4) r1 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000040)=0xb0000) [ 506.239276] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 00:50:16 executing program 3: socket(0x0, 0x5, 0x9) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KVM_HAS_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee3, &(0x7f0000000040)={0x0, 0x3, 0xfadc, &(0x7f0000000000)=0x2}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f00000000c0)={0x0, 0x9, 0x8}) 00:50:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x0, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0x200}}}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x23, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0202}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) 00:50:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x4, 0x70bd29, 0x25dfdbfe, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) socket(0x26, 0x5, 0x0) 00:50:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$IPSET_CMD_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x108, 0xa, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x2c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_ADT={0x38, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x9}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0xfffffffffffffffd}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x7}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz2\x00'}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x1}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x40}, @IPSET_ATTR_IFACE={0x14, 0x17, 'veth0_macvtap\x00'}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x1d}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x80000001}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz1\x00'}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x40440c4}, 0x84004) 00:50:16 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:16 executing program 3: socket(0x25, 0x0, 0x9) 00:50:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x20000000) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x5530c0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', r1) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1f}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @empty}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x1) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getsadinfo={0x24, 0x23, 0x0, 0x70bd2b, 0xec3a, 0x0, [@replay_thresh={0x8, 0xb, 0x4}, @XFRMA_SET_MARK={0x8, 0x1d, 0x2e55}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004005}, 0x8) write$cgroup_devices(r1, &(0x7f0000000280)={'a', ' *:* ', 'wm\x00'}, 0x9) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/attr/current\x00', 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, r2, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x9}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xf9}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'geneve0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x881) 00:50:16 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="78009e560000", @ANYRES16=r1, @ANYBLOB="010026bd7000fbdbdf251c0000000c000600020000000000000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB="0c000600030000000000000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="08000300", @ANYRES32=r8, @ANYBLOB="0c00060003000000030000000c00060003000000000000000c0006000200000002000000"], 0x78}, 0x1, 0x0, 0x0, 0xc891}, 0x4008004) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20040885}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}]}, 0x28}, 0x1, 0x0, 0x0, 0x20008004}, 0x90) 00:50:16 executing program 3: socket(0x25, 0x0, 0x9) 00:50:16 executing program 2: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xd}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x7b37}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wg0\x00'}]}, 0x60}}, 0x800) r2 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:17 executing program 5: ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) r0 = socket(0x1f, 0x1, 0x10000000) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080)='l2tp\x00', r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="02042aba7000fedbdf25020002000c00100000000000010000009afcfddfa2727465f7d486bd5181a9b7323700cd5c2714c9de9f9332c9129bbbba42d51c87adbd278dea56bed57a7f16eed0e9ceaad7bbe8c617b26a4ed887c60e9ad6934cc205f401ed0b87c962eee74647cb5ef027a8af91f7f6a16d1ce74a7193690ac8dcbd47faf17499202eaf7de3d0341812b96a8fe44ee3e8c74d6c5f3a30a5d5b9f225c29473eed19981567122b638263a9ddde8831c54cd353fb51ce0130876a6b940252df62e"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008000) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB='+\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000fbdbdf252e0000000c002d000201aaaaaaaaaaaa0600060001000000"], 0x28}, 0x1, 0x0, 0x0, 0x2000c080}, 0x20000004) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f00000003c0)={0x7, 0x80000001}) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x5, 0x5, 0x5, 0x0, 0xffffffffffffffff, 0x10000, [], 0x0, r2, 0x3, 0x1, 0x4}, 0x40) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0x644000, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000440)={&(0x7f0000000180)=[0x76, 0x0, 0x1], 0x3, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x7e1], 0x1, 0xc2433c1dff22e90, 0x0, 0xffffffffffffffff}) sendmsg$IPCTNL_MSG_CT_GET_STATS(r6, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x5, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x2}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24004000}, 0x40d0) io_cancel(0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0x81, r3, &(0x7f0000001240)="c9bdde15cba70250e709212126699b7413725d26f380ca72aac80a690bf292977c7c2081557cdf6fde2fa61b2e44077d6bb1d261a1a4dd851d9b3e0ab474405e6be5b60680ef9033178cf01f26a607cc110a70d9a4d1ea17107b2cf9712f981712d0c02f801421a6d452de1f9612d96eda51de08ab0d6cc50992db7b8783d62b616408f04e0a32d7c5eb93a7c19322cf8d146c87803ad8351031021bf4610e9c28909efb227b874836a69286f04c40749a0a52546df868abac3dc0c12e70120bae71947b40ad98f0f517b3a6d0b64e589941e9e003004980850cfb27eddc4ec35883c6d811563a3af6584c9927f1b7ecf31d07aae1eaa5dbf08e889da3017ab3fe573d43361473b4db6aef6dcd5e004c4a3e6b7ee1f62826ad8686585aa3fafcdf297177c83b8125269a9c6a19dad398dfab5ce85c9cbcee25c43ccc2518948b217f14aa1bfcd17f4194067f4fb31c7983b9209baa325614b07e4f1dafc794b25bf55b2064d4cdb9480cbe94c968e5b8896afe38235c416b7a81f314414e5cdc881f0c9026670c1649e69387f1d64570569d58ad0952292462ebd8c22a475f1686ec19f163ea3f2e12f66327fa0933868c1c397a10a9d0039884509caa87b9738655f270e0548ee32c45f064dfd05a1fd733ae93fe66838539ee43fe129a3515e6f6424276a4a8db071b0eae5814ccc44d470ce9a2248cd6e99dac47b7b695405d61778d20fd384273bdc0ff5f3e0f9b80f28527c619dc9679c7da31143a930bccd3b7aa91c388a6f59c044ffe252c39ad7e34500bc8e2a27ecd29a744e51f582f9341f4f2e6a1d0f2ccddee0401be312a6bdd21340c1124fa9b9dfcc16a3ce53661ceec42ad823e1ed19f75874b3ba825b91b4fa12e4778825375ca875c006135a9eb53b502cc209a209d215948cbc78d5b80ae3404ed29b288f047fb3135b0560da3d89d9a8540b1520aff6831137121f6c6bdc34e014faa3ef0d556922045564c4bba8e3150a55676a4e6ae84f694c5655d9d7d4c1a977507c177e8b6fcbc84e024fc9d303d4970cd960591356ac329537ec27d4ed9b80c0a37031066b0f555eb422f64296cc37d7b239c94f72b304bafb6e48689a8e47f347fef707249bd0d156dc5d55f09d2ad2d6eabe763932c4cb5b3baaadb430eb3f0c4f22c4de884bc745646a64602d9facb665098fcd11276363e22df98c1915f7a6a81f07fb4bc8967af1335a7c0ec8fe9086a5bc1b68724a1dfafe26ad330c5a42afa1981471ad29730e48a23546d121fbd8fa45bf4df0d919248f071f1f1e4d6ecc239edd3ed47a2069caa06842ebeb80840fb18abb86a76a84e0bf3af36be006fbac6fde46f667d162a9290084a5b68d3b93d3b4baab055856f17d09dca26498be5350b607eb3d2f584058963647e088fb24d2e265359dc8d2e4fc6559f344990c04cf04cf0b04344e1acbc7debaf6f31310c44ed3d118e6552d8352d0447cd18ce244d6bb2853d1f9638146cd52a6f995fc0ca9221f1bba86c2c59e443c1f02b80461d7879238ff8295f53b74b2ac29f1d06f91135ccc95df96b331ceb77a7131e072e3d2f74edc35f2017da354f1f79cabfff1a35ae0f8f752d123e39b4691b1da5eecc835adb4c71726b11c9cdc9f4291f45baf59907e73cac6dc5d33a3bc60174c3b424734f85842f9142e4bec1c5f1c4f81ffe5824c43aa8bc2a7fc95bb5c9ab38fee2193862eafb8d32ce085e76f60502a6092882ccb859d9088a9ed1325b163d9d80549ba83a72e3f137eac46be42e00d2eed934802a89f3b215ec6f508ae483de7d60fdb52bc8d50707f13f48f8f260616ee67601072fae0c272a9f4487c42d8944895d48f48428da837bebb4c7531ae13117e3db9de352ace2ddece78215bc87160116b8469d69a3551157f5bcb6b1e0a1cca1527578380cc35661c6af83b7ee66210ef8c222d7f699679a44a715335f88df2bd14ae8c8fc596ace0ee93c09bd274a1cd564d536e5eb6622150280381b19390e96f74db67ac5b991bb217607ca7769ef4e8d82af47c09fa18c5ffe46d62a5bb271651cf023a15e2943b57078b4a9650738fae268a9b968d2c6118b62c02284f9e74555cfbef772335890784d1c79a0596657dbae461aaa5b60d7b70b1dab11e6e499ac63d5d50ed787a5d202ee1a91e0d12b300d2171cef5af4ba3903b49f4084cc01f780cc60861f90ff6d6d0c8ebfda1939838f96790fe5982c20fd739990fcc5fc521f301cd07d1e9d2b39995030c67e12646b62bea6c9f35b03c0fe1f38f44080df309d79ea11842ad03a190e51183fe32f524bb338792d2f371f4fff58761d1f850dc3e67806969f581e5e4c5fec10a5e549e27c9042eceb4ce2aafe3f28901beba7aa6dc92a35b20f8b13fa83137f54a0401a48859aec21a873d9640c7e9b9c09f9bbe67b2bf948e3b754b171f11927df62572c0d8f302b58bad63b8f57d650d20a25e2384ef6c0058e51bfed16b5ab167988bc0675c78d53242b680889613c5a1818156715dd59a6b2f90fa976a132aee489497d4c84b9df200473e551a79e75a8cebcd84be5a83a172558157f2474e514614247e58ff119ce0f94bb8b6fb6da0c29739c35970c0608f2bd5424a3e43b759ddc638eb00eaa5a273ca8337f0d4d95ba39a3af784b88fba6fdea8ba0ddd14fafb17e79a0aa30f718807e619b3ad3e1c4f5b780e56ff7db67e5c3d7ce5f9d3d3582a1b47bc84d7b2fcc7a19ba55d0b367b13b186448b3ce52bc59b38266b610f8bfdd24f5a0c009a7ee0faa7af2e56c858064e09327908ee5fa539890b91b7380359ac5ad5c7eec35476e969f95a7a509041cfc2300c73b3f8808d59539cf20c098038866fa41b711e2995c8b8102b2c521d7c88d380a0a9aca6ce1518c20d612123e3d15b1b71958a426cfd87044e8fa6bddb8a38c4529b664e774ffde29013f5bd94954abc43c4f74e699c47160c48b9487d0fd04c2e168052b21091a9b3bb6cf3999a107bdd0ba111badbf6a2198d68b54dddbe02d8bf33539bae67fef64a2a984a869b14f3d8ae772a69d985eada025c10f691e073d85d86a979b1eba6a6ad4db4fad166d7b74f8d299d4207edd4a05ffb0519701d6db5092f82c2eb143621e8b3e637809a1dd8ba09a3451a7438ad2d1515fc5dae917f8f64f9daa55312fbdf9821fda46d08e3e6060a815b6ef5a083c3155056acd2895337f4c84ef9a11a94709d76ff362296ea098f180d1698e99b2494a768555a1a50608a13bd12d0b4abcb3ea35abd37ea738f88d6b85eccc9d4e2785f9791bcadaa53fe7a7d2ac0507fb1de40c471b6545bccdc5c1d85ef3779ac0095a2a25ec3c8b9c34eaeae980920a5f5e4038fe49608e8c6d6332b3512dd506e357caa6e05397ccd06e5eaad243c7d997bb0031ffd886e1596c28ae117ae57a5093d864959056a72b72acbffff81b510082ec06c24153ca4e751ae3ddf70a624ba32f6028d91d768e1f961cb9bd94bfbefbe12913739411f569c47b8d15cdf379fc63a0afc817516815a14705095c820b80cce369866a817a719c2a26d74eeef217a5aeb652163ec03542fc61fbcca7f992709a9992aefdc51d38474b5cb1ab428b3e462e8312330fa791ca296bcea7fa0a703d43b15f810b96a856ad603b4feb8ab491ddc23fd9b198df16126752eb83f4d5ae63296134d59f4ceba021f41e1eab3776936e2b51f794e2a8e706f001ca4b114c188589072d379db01b586a9787585ad3c8a651e0189e3954c58f6aeac8aa61135b1713603d25475916b00c7b65dcd4c696e75d86bf727d6809eab43a2624d017d97c2a2b188c47284477d90865c364441bfd626ce4e9a0d1a30790ab7a0983d9714476dcd0afa86c980e9b70afec87e45e4d2e8a81d4de671501be27a4b939ee98227ea4e9c6b3517cc608b59002ce52bbd42e05a034dbf6ff0226ec056f832a9798ebfa5f3f129cf261bc1e4efb795bfb3c8adb2c8650aa65d68b25135c3d0bc1df2d5694a6fb2cacfabd1e7dc4f398364a00fd2b50d7c814a6f24b1a225b42c03e32d7ef7878291e4e98b7f0fec20e3396a8bdb9b5296e94e73bdb8e020d60d544071cd2d8fe7142a9403a785fa0c2e11e9e2a430e64a90ac81c54cd333bc97af19eef5bae7b05e203a6e0e431b62bfdf056fb181fc15c5101cde077acf83a0c53b5135887d160df94bacd94404acc4465186f060375c7ca4ed727589ec1adb4aa89dfc017acf20f881e83f334a0642d1901573b3f5a8ab06fd8232ba01e87cce52e87e6ba82efe20a8c0ecb8d2dcf8efec99a179676a349882719387c1980941f9e7c7acb18b9fdf974729f24cfbbf3b50f6a09e55bcc4a97217b1a30248ccf9f4e8044e101ddb023d9f511870cdcc3e920956c35fdf025f98cc89f4ab86d2e90db7b6ec77afeaf5385f452cfc111a4e67cf31d3264ea24daf6825a61896ba0e2947dcaf20c74bb56927e56bc582be3f78706c4749317dd01513a44f89ce48430af99c0eb6502093617f7df81c5099bbacb40783ab48d6d44ff3ae5c9e019556f352c9a64fb618e552fec8baf239ba837b5bcb84b30b867df968508b58c5341cd7c4596a3c3812024e65e8fa3728a54069a926e096c62716a72e72e64580b8b40894e7c7288613abcdb4e000076a57f1a7bde0a64128ccaa644a223ab95074bb919e2265ecebb2b12908cdcacb0257e067c73661b9ccbc19ea4ee7c12fe30f06a91e019b251e3cae607c157921482d9fe19d065135826ef7e5b7ebe5b75950f328e1a5c2f876ac63ebf1ccb5d9d64314c967ba04ace79f0c64f8b53e5fa68aa90d0cc322fcf674bd0f9358dc3bd84983bbdb1042bac624b367bb5ca83b819fb015e1bbdbf9140129a1fcf0f3880c33e852ddafa98b379a90b81321a2ad49547ce92bab8f063c2cbf5fce029a7d823b00e1ceed1b3c38048ba20adfe890008efaf449885b6bc8361b80a1ed4a9787d71dff7bf43fb4cce593c79b391cb7cfd8bf2f5e630d90f5e76285b6728e490460bd24ba15e3dced973089d42faf84a8309243dd465dbc4f2118563d8f27e67e96c54182ff59c268909f249e92bae5a64d007d64c9b031dac43e012a8232c872b5a01b1cd1f643d0243a30923616629d1780876008ae7f33a217b8d26fbdc1af483c8dc95a0c2d2d0f2ed47f798d4ee2183cfb90136c8f4bc636538eeb01391ee1da9faeab18dec19fe6d4c0375a2508d13e6bbf2a206095c96152b9d3cc7608c032b96ba51abbfb7499f52bf09b795af640a009c92759752dd3effe401eb4c797bc4c1afed2dda88adb2885751a3137906547bd7e0de287ee6db28876a46b4f40066b6190d28ce8984b2f24f07619e0cae1179c8aaa90d56046124494556d508a857436e10f5567ca37553312108fde5a530fed606499f5d3e92e518f21e83e2babed0e61fa6943cc1b80a6c8e7ed1b9b6d899bed3b91d46bdf050d99c9e38ae7b6a9a344607759f06c6c7310c7b38027bd3403e4f97d577cf1ee10933e81b98ebe3d67064ad64cdd0662db0c290e356bdadbaf2f47f7dfdf3837a2494590a6c27f0431f2cd384c64b1853b4f1ae549258bf9a149d1371b6fff62e93a58a352a7b3db71105fa2cf8daf193d9e8a26c6fce8135e2e9e91675f5f8bc1e1c972bc6ebfa75a0d750ef98292cba53c9fc43e70a5c9103dfbc85265996f8161b1f37aba4c41580038d4073a56280e31b1260bff55e8263d89e68e123a471f1878834cc81dbfc64516e22b66185a34e7419fc2cd73b020c6e74c82262a0558ce9093cbdf3b", 0x1000, 0x5, 0x0, 0x3, r5}, &(0x7f0000000240)) 00:50:17 executing program 3: socket(0x25, 0x0, 0x9) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000640), 0x0, 0x0, 0x0}) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 5: socket(0x21, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x80201) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 3: socket(0x25, 0x5, 0x0) 00:50:17 executing program 0: getsockname$l2tp(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @initdev}, &(0x7f0000000040)=0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80000) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x400}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4100}, 0x4008000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000080)={0xffff, {0x200, 0x3f, 0x6, 0x6, 0x800, 0x7}}) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x18, 0x1, 0x8) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, [], 0x12}, 0x8, 0x1}, 0x20) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x0, 0x4) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000040)={0x214, r1, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVKEY={0x58, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xfffffffb}, @NL802154_DEVKEY_ATTR_ID={0x20, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xf39}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x80000001}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x10000}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_SEC_DEVKEY={0x40, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_ID={0x24, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x401}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x10, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}, @NL802154_ATTR_SEC_DEVKEY={0xf8, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x4}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_ID={0x64, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7ff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x20, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x9b7}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x80}]}, @NL802154_DEVKEY_ATTR_ID={0x6c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaaf}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x10000}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xffffffc1}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVKEY={0x30, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x2}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}]}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x4800) socket(0x29, 0x80000, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEV(r5, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x54, r1, 0x10, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x54}}, 0x40000) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 3: socket(0x25, 0x5, 0x0) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x1001, 0x1}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x3, 0x8, 0x6, 0x1, 0x54a, r2, 0x8, [], r3, r1, 0x4, 0x1}, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1f000000810000005e6efd28ebe4102869eb87cace4551d0493126257f10030c3c1d4e1384f1198ee4e6e2cdd49b4aa880b0d0e56bab71e8d14865c8225522", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x34048800}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x81}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x840) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000007c0)='802.15.4 MAC\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000800)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000880)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x68, r3, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x40040) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r10 = socket$can_raw(0x1d, 0x3, 0x1) r11 = openat$cgroup_devices(r1, &(0x7f00000004c0)='devices.deny\x00', 0x2, 0x0) r12 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) io_submit(0x0, 0x4, &(0x7f0000000740)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x2, 0x3, r1, &(0x7f00000002c0)="96f815347f326adb459da7ca96cc741e298888cae1365789a417eb0c94026c502a206b334c487fdc3fe13b3c992f3ad8f9c47bb8c5d5b8db7cca2bbd5fb30c93d0c9e95225d0eab7f3d275e2cde060008c85dfbefc2222b9d4d39dc33f3e6ceeea82fc34", 0x64, 0x5, 0x0, 0x2, r2}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x3, r10, &(0x7f0000000380)="8fb19fb39d14edf3ce427e7a008b1a5acb0d6118034c961c39af7d9da9230879d63a16ed0021bf81e36af72d8032a0ddc13339e785c47940e6f92509e25f8bbeb8c1025b8a042974ab69eb005134f35bfe79b213d9a14eb8f8a88268e31cf0c2beaf9bb3a9308dad7ba49101cf8e4d602fa50fc7e92f6597b128475f01f050b9cc5ade1c7afcc7444c314644d8782523c857b375a58649187a844b942e01a01c465afe2fea8a232928d73ea56a4e360a25ae303e144a454d656dd9b3457a030db1", 0xc1, 0x0, 0x0, 0x0, r1}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x5, 0xc76, r11, &(0x7f0000000500)="7f7911fe3cb194950b7bcb41e1ef77dd4cd26e22a8571a68796fb2a8e23dcef33ca4995aabf5efabe4f12f80b659181afe9937819464376ba3a19d37026f9fd862581637981f22fec8c0c49e85e02f1b539a6285efc30089dda8cd015fb462e749b319cdd7ae348aa6645729981613f726", 0x71, 0x4, 0x0, 0x0, r12}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x5, r1, &(0x7f0000000680)="57f3fc74bc6a3aeadfdbb0af9427db4caa10eceda2a887c34e01f6413e0aadbae5e74ad8bb64dfc7029ffceb695dd8d80d324b1d981554426c13a14033681133412b3ed8540dacae3dc77da8ab5d69e6eff706bd6e375aba2d643baaf04764316ad6252c8db02fb9c6ce1a472a2628c52264023d1e84ea4a4912680a5c1d7ae735fdd0913fda2476c986115ac9296b84abf8313850ca7d73ecc7da8739e50d898d21a73d52", 0xa5, 0x3, 0x0, 0x2}]) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=@getsa={0x1e8, 0x12, 0x10, 0x70bd2b, 0x25dfdbfc, {@in=@dev={0xac, 0x14, 0x14, 0x2b}, 0x4d2, 0x2, 0xff}, [@XFRMA_IF_ID={0x8}, @algo_aead={0x10b, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x5f8, 0x200, "34483f2bf270903ed8511a421efbbe7534aca9197e0f2d394d8bd2ef612ee2ece4c13c381e904687de3b8df878426c49bcd1b30018cfd1aa95e453e403956c47beda9d384e87fbad4b98a2db165b43bd0d9033d36151255df9bb5757e77994cb679a0a98cbd136cd2cf61b4223d803e004778face58006b3e843f8c8bb684a46d18993e2527acde6f293154aeafc25981d6d5311194f14b37dec7ac713609be0e8b0c52ba95d693b4a09bc7be3e14679b01064a46e4230a80caddc8ceac5bb"}}, @etimer_thresh={0x8, 0xc, 0x70c4}, @algo_comp={0x99, 0x3, {{'deflate\x00'}, 0x288, "c7bc9896beebe8863a33404545770fd2ebf5f0a076a59cfd20b5ac38df976f6f66860f97c3a1b911d4f5ff864bac2f6e25b83a0d3db5a2188963bf848eefd8104913109b3e655dd5b613e96e4e9dbd3ef5"}}, @tfcpad={0x8, 0x16, 0x4}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x20008800}, 0x4004015) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 506.863084] binder: 2813:2818 unknown command 31 [ 506.877547] binder: 2813:2818 ioctl c0306201 20000800 returned -22 00:50:17 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:17 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r1, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xce}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x2200c010) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x4800) [ 506.937815] binder: 2813:2826 unknown command 31 00:50:17 executing program 3: socket(0x25, 0x5, 0x0) 00:50:17 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r1 = gettid() getpgid(r1) r2 = getpid() r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r2}, {0x0}, 0x37bf, 0x9}) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f0000000080)={0x401, 0x7, {r1}, {r4}, 0x4}) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000080)={0xee, 0x1, {r1}, {}, 0x100, 0x7}) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 506.972308] binder: 2813:2826 ioctl c0306201 20000800 returned -22 00:50:17 executing program 5: r0 = socket(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x401, 0x0, 0x0, {0x7}, ["", "", ""]}, 0x14}}, 0x0) 00:50:17 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x480003, 0x0) getsockname$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, &(0x7f0000000100)=0x20) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000000)={0xf, 0x1000, {0x55, 0x2, 0x0, {0x4, 0x2}, {0x4, 0x200}, @const={0x0, {0x5, 0x3, 0x4, 0xaf00}}}, {0x54, 0x401, 0x1043, {0xffff, 0xffff}, {0x6}, @rumble={0x1, 0x101}}}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x200440d0}, 0x844) 00:50:17 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x20, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x800}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x30}}, 0x8000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4008804}, 0x0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x2, 0x3, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x53d, 0x2}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000050}, 0x80) 00:50:17 executing program 3: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r1, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xce}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x2200c010) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x1, 0x4) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x4800) 00:50:17 executing program 5: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_getevents(r3, 0x1000, 0x0, &(0x7f00000000c0), &(0x7f0000000080)) io_destroy(r3) socket(0x26, 0x4, 0x0) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f0000000040)={0x0, 0x4, 0xcff, &(0x7f0000000000)=0x9}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03b882630840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:17 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x802080, &(0x7f0000000080)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@dfltgid={'dfltgid', 0x3d, r2}}, {@fscache='fscache'}], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@smackfsroot={'smackfsroot', 0x3d, '&\xd7@+'}}]}}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) select(0x40, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)={0xccbe}, &(0x7f00000001c0)={0x77359400}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:17 executing program 5: r0 = socket(0x26, 0x5, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x28230020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="cc0000000a06010100000000000000000100064000004a36eadd579144fbfddc08001c400000008040000000070900020073797a30000000005000078015001a002f6465762f646c6d2d6d6f6e69746f72000000000900120073797a300000000014001700726f736530000000000000000000000008001c40800000010c001b40000000000000000808000940fffffffd040007800900020073797a3000000000080009400000000614000880100007800c001b4000000000000000800000000000000000305a2db93bd5122dc9f1b01c9a81c980b7e8d370b7c0e57d5e768339238ecb3e4e029f41aa8e6d0f19c6c5b87713409818eefa708f26fa54ff52fb92ee98b7d4121beaf9d47da1b809d7be914042fc1d42de253bef2dfb25e680"], 0xcc}}, 0x14048084) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x4000000) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x5, 0x4) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x2400, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) io_cancel(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x81, 0xffffffffffffffff, &(0x7f0000000000)="7206b3bda3d8d8237b7facb4d72263af2c9391d63edf9c48e151fedd95fb33aa5d957de23b8cb5a6d1a86225f0790da064676cc9e40311ffbcd4f9cefd1dbe9e1032dae435ac90f8922ee899478eac4525c416f17690e39b8ea8b233053f83ef2d1745b3c1ed0ce35e0d6369b7406a2a57a3fab35d30fedc8c7ce4dbe438affa2b6bce524e45d52d3128da8d0bdd07f8e65b43c3d0d15abd6e3ab24951357a055652e96785", 0xa5, 0xfffffffffffffffe, 0x0, 0x3, r2}, &(0x7f0000000140)) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200)='l2tp\x00', r1) getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1b, r3, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x80) 00:50:17 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_getevents(r3, 0x1000, 0x0, &(0x7f00000000c0), &(0x7f0000000080)) io_destroy(r3) socket(0x26, 0x4, 0x0) [ 507.296090] binder: 2885:2892 unknown command 1669511171 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x3, 0x70, 0x1f, 0x5, 0x0, 0x0, 0x0, 0x9, 0x80140, 0x4, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, @perf_bp={&(0x7f0000000000), 0x1}, 0xc000, 0x3ff, 0x7, 0x0, 0x4, 0x4, 0x20}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="036308401e28cf04a5cb2b5465b8ca1f27dd75ac08c18fc52d30d2f8ccfba6508c707061cfbd32f3e6f253589fe6ad5c18a122ac137da838056b52ecb458259f0813294471d2eb4488fd0f52428f2a8c75015d5a66a5a301a72c5998087764b2617766a3044cc4", @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 507.348925] binder: 2885:2892 ioctl c0306201 20000800 returned -22 00:50:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x8000) 00:50:17 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair(0xf332e0890b05804c, 0x4, 0x4, &(0x7f0000000000)) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:17 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000040)={0xa, 0x10000, {0x57, 0x4, 0x9, {0x80, 0x69}, {0xbb, 0x1}, @period={0x59, 0x0, 0x3f, 0x1, 0x8, {0x20, 0xff7f, 0x0, 0x77e}, 0x1, &(0x7f0000000000)=[0x3]}}, {0x51, 0x7, 0x7f, {0x9570, 0xf5ac}, {0x6, 0xb5ea}, @ramp={0x795, 0x5, {0x9, 0x401, 0x7, 0x8000}}}}) openat$cgroup(r0, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) socket(0x26, 0x3, 0x0) 00:50:17 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_getevents(r3, 0x1000, 0x0, &(0x7f00000000c0), &(0x7f0000000080)) io_destroy(r3) socket(0x26, 0x4, 0x0) 00:50:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x7}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x2400c056}, 0x80) 00:50:18 executing program 0: sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="5400e4ff", @ANYRES16=0x0, @ANYBLOB="271d25bd7000ffdbdf2530000000"], 0x54}, 0x1, 0x0, 0x0, 0x814}, 0x20000000) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x200440c1}, 0x0) pipe2(&(0x7f0000000140), 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x19}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x48080) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 5: ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000180)={0x5, 0x80000, {0x52, 0x8, 0x20, {0x8, 0xffff}, {0x1, 0x9}, @period={0x59, 0x6, 0x800, 0x3f, 0x8, {0xff, 0x3f, 0x0, 0x3ff}, 0x1, &(0x7f0000000100)=[0x1]}}, {0x53, 0xfff, 0x1000, {0x7ff, 0x9}, {0x653e, 0x1003}, @period={0x5d, 0x8100, 0x7, 0x1, 0x3e4, {0x1000, 0x7, 0x6, 0x43}, 0x1, &(0x7f0000000200)=[0x3]}}}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x20a540, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000040)={0x3, 0x3, {0x57, 0x7fff, 0x1f, {0x4, 0x8}, {0x2, 0xb8d}, @ramp={0xfff, 0xfd90, {0x8, 0x5, 0xfff2, 0x1ff}}}, {0x53, 0x8, 0xc276, {0x0, 0xfb}, {0x0, 0xff}, @rumble={0x4, 0xa8}}}) socket(0x1, 0x5, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f00000000c0)={0xe500, {0xb2e, 0xfff, 0x79b, 0x2, 0x7}}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x3) 00:50:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000000080)={@hyper, 0x1}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="5fba17888d5e92f5dae45e0021", @ANYRES32=r4, @ANYBLOB="08000300", @ANYRES32=r5, @ANYBLOB="050012000000000008000300", @ANYRES32=r6, @ANYBLOB="050012004300000059b06b50016470410d61c56b4b88f78b657c9d9bdf3d3d798f330798c532459f5755c1633581320e5928c9406ce0aa9871ff07f6ea0db5af7afa68c85e71c249edbf605b0fd4fdbdbd0804fcf014e0b6decacb0468277f21575f2752b75eef20fc9e6232d3ee9d5cbc87fd53"], 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a8010000", @ANYRES16=0x0, @ANYBLOB="080027bd7000fddbdf2517f900004800258005000200200000003c000180080001000000000008000400400000000c19f4b2873b61660005000500000000000000050002000100000008000400080000000c00050009000000000000000c000600000000000000000008000300", @ANYRES32=r3, @ANYBLOB="18012580050002001f000000b000018008000100020000000c0005000100000000000000640003800c0004000202aaaaaaaaaaaa08000200000000000c0004000201aaaaaaaaaaaa0c0004000202aaaaaaaaaaaa08000200000000000c000400000000000000000006000300a3aa00000800020003000000080002000200000006000100010000000c0005000000000000000000080004000300000008000400000000000c00050008000000000000000c000500020000000000000005000200040000001400040084fe94f448bcb9d746b61d9112ccee4405000200800000001c000180100003800c0004000200aaaaaaaaaaaa080001000200000014000400c5cc6914eb207b1e51868f7018e2b6d9050002007f00000008000300", @ANYRES32=r4, @ANYBLOB="0c00060002000000000000000c0006000000000000000000"], 0x1a8}, 0x1, 0x0, 0x0, 0x20004000}, 0x40000) 00:50:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0xe14fb76b1cef1cde) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="03ff004063cca0e643dbd5eccb1d6110a43fc5a543949352090d7825f5744d9137492375437ee9695d9231db5e2ca2a7993542e008be48a0bf497d0c4531d8e9d096638cd0fc4d6c3e3bac477d3d664f22504f4f3e0ede9dd1cbeb92677ecff01373c6b296693eec12dc561d80ccf7ce87889873ec56175146a35154ca4eda0963574eab911a1ef366a34546d8d6b5dba8d94cae54ced29664ea953851d24659d5fbc1a13d22da49d688d92a701f07d2604c3baf1d9b90dec177f857fc15436e4b8518e5", @ANYRES64=0x0], 0x0, 0x0, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000180)=[0x1, 0xd482, 0x1f], 0x3, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000200)={0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x2}], 0x96, 0x0, &(0x7f0000000080)="eafdaf0f1351f3b1b48d9a4ec083d0d6431f8dbdd80bfda77e13a74cc21f4f6743dc2605b38b4c96df153a1cf1393652da0c5921e308e35f9f483de1cc9b00860edbfaffd673f8e4383a94bd1d9082f10eb4da257053b6f676e0cc4cac4ee11a06b575ecd8a44e8cc3729f2cd9d116d702c5c5b46e95e6f06d257ee1a10adc9ac4c776d18747c2abfa9e273ad6bafbaf3facbb09d769"}) r3 = syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x1002) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x8) 00:50:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00', 0x0}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYBLOB="140429bd7000fbdbdf251100000008000300", @ANYRES32, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB="05001a000366000000000000c931d5f43610f8bc43a3306518ea7eaf287f46ecd64f8b6cc770be235e24f3e1f2ce4996b27be01e2c89a6469912c0796a25c283be2d1f4a4a358bee33a1c5faee44d8a2139b4bfe1d951ec654248a43a7ce6e34af6fae6d7b5d9af887dc8cef52262ac783cd247577c4f43918bc6ba000077fc73cd70f82ddfe76f19b287787addca7652d1cfe7a3247be67040000000000000060b76f36c9802556ef83986e6b3f3c30febc2e3501c86849886a21539ed4021c855a2d47ca660ed298b8e0cafde2329b2f21a0975d8621429779d1808e7b4548c09fbd9107efb7697177842ee2ba56bc6ccbe1b33bedd493e45c6dc96a4c00"/267, @ANYRES32=r6, @ANYBLOB="ff03000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x8004) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan3\x00', 0x0}) r9 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(r9, 0x113, 0x2, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000380)={&(0x7f0000000840)=@updsa={0x2bc, 0x1a, 0x22, 0x70bd27, 0x25dfdbff, {{@in=@remote, @in=@multicast1, 0x4e20, 0x0, 0x4e21, 0x2, 0xa, 0x20, 0x80, 0x89, r10, 0xee00}, {@in=@multicast2, 0x4d6}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x80000001, 0x737, 0x100, 0x4, 0x1, 0x9, 0xffffffff, 0x8}, {0x20, 0x0, 0x81, 0x1}, {0x9, 0xfff, 0x1}, 0x70bd2d, 0x3505, 0x0, 0x0, 0xfe, 0x25}, [@algo_crypt={0x55, 0x2, {{'ctr(blowfish)\x00'}, 0x68, "6eb54b67519c9b3b75007f7c03"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x3}, @address_filter={0x28, 0x1a, {@in=@rand_addr=0x64010100, @in=@empty, 0x2, 0x0, 0x9}}, @tmpl={0x144, 0x5, [{{@in6=@empty, 0x1, 0x33}, 0xa, @in6=@private1={0xfc, 0x1, [], 0x1}, 0x3504, 0x3, 0x0, 0x5, 0x7, 0x217, 0x6}, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4d4, 0x32}, 0xa, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x0, 0x2, 0x0, 0x8, 0x52df, 0x62d, 0x81}, {{@in6=@dev={0xfe, 0x80, [], 0x31}, 0x4d5, 0x32}, 0xa, @in=@multicast2, 0x3500, 0x3, 0x3, 0x1, 0x5a, 0x40, 0x6}, {{@in6=@remote, 0x4d6}, 0xa, @in=@broadcast, 0x3506, 0x2, 0x2, 0x1, 0x9, 0x1, 0x4}, {{@in=@empty, 0x4d6, 0xff}, 0xa, @in=@loopback, 0x3504, 0x3, 0x1, 0x80, 0x4, 0xffffffff}]}]}, 0x2bc}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NFT_MSG_GETRULE(r9, 0x0, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$IEEE802154_LIST_IFACE(r11, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="b475cb0e", @ANYRES16=r3, @ANYBLOB="20002cbd7004ffdbdf251f0000000a0001007770616e48c32993c6f8feb447310000000a0001007770616e330000000800020074ef0a409e9bb585c2ab17b9bcf300969867b490ee60b76b3e403675df7ccac4c2478ab2f7db27b142b813cb8185bf4836fd456a2651cfca8c15f7babda29117e3140f98046a89ce857f2e14bc7a5f49cb34d9475775e61a94fc70fbec5334021ad09be63557c3090b58e2e5ab0befe16ffcf868cd0f938e165808a4cdd4dc7451477830432c6867a43fcfab70bdcd3ceb67e97efc7b43a23f0c4bb6145de38f6900"/223, @ANYRES32=r5, @ANYRESOCT=r9, @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32=r7, @ANYBLOB="0a0001007770616e470700000800020075577a4d1277188ad1c548b9aea674e2750667b50ca9ff0af89b675fd6b03348b9a3323ee8e49393686ff237bcacdf589d5adce86339146396ccb79b2853f8128eb8ac95f34cadf8fb86b4ee15059547b13319c0ba01ea219327baff49e4a345a8c9397b3c209a41bf9e881db837f9fea8b3aa99c5d4060b2b5a17580bc7c173", @ANYRES32=r8, @ANYBLOB], 0x58}}, 0x4000000) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_getevents(r3, 0x1000, 0x0, &(0x7f00000000c0), &(0x7f0000000080)) io_destroy(r3) socket(0x26, 0x4, 0x0) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r0, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40890}, 0x4080) r3 = socket(0x15, 0x5, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r3, 0x111, 0x5, 0xfd8, 0x4) 00:50:18 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000000)={0xf, 0x48e, {0x1, 0x4, 0x8, {0x6, 0x8000}, {0x3, 0x9}, @rumble={0x4, 0x6}}, {0x57, 0x401, 0x7ff, {0xba5, 0x7}, {0xfff, 0x48}, @cond=[{0xbf, 0xb92, 0x8, 0x40, 0x5, 0x2}, {0x7, 0x8, 0x5, 0x41b1, 0x1ff, 0x3c00}]}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 507.693625] binder: 2950:2957 unknown command 1073807107 [ 507.727595] binder: 2950:2957 ioctl c0306201 20000800 returned -22 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 507.753672] binder: 2950:2971 unknown command 1073807107 [ 507.768743] binder: 2950:2971 ioctl c0306201 20000800 returned -22 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_getevents(r3, 0x1000, 0x0, &(0x7f00000000c0), &(0x7f0000000080)) io_destroy(r3) 00:50:18 executing program 5: socket(0x26, 0x5, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000000000)={{@any, 0x3}, @hyper, 0x1, 0x7, 0x4, 0xfffffffffffffff8, 0x1, 0x2, 0x9}) 00:50:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x430000, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000040)) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000000)=0x3f) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="03610840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:18 executing program 1: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x4040000) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 5: socket(0x26, 0x5, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000)='802.15.4 MAC\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xd4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x58}, 0x1, 0x0, 0x0, 0x840}, 0x4000000) [ 507.883485] binder: 2990:2995 ioctl c018620c 20000040 returned -22 [ 507.925376] binder: 2990:2995 unknown command 1074290947 [ 507.960107] binder: 2990:2995 ioctl c0306201 20000800 returned -22 00:50:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, r3, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x0, 0x0}}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x34, 0x0, 0x200, 0x70b52d, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x40408c4}, 0x8000) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r3) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) 00:50:18 executing program 5: socket(0x1, 0x5, 0xfffffffd) 00:50:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.limit_in_bytes\x00', 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r0, 0x7b1, &(0x7f0000000040)={&(0x7f0000000680)=[0xffff, 0x8, 0x1ff, 0x1, 0x7ff, 0x5, 0x0, 0x5, 0x40, 0x2, 0x6, 0x40, 0x86, 0x6, 0x87c9, 0x1, 0x7, 0x40, 0x5, 0x6, 0x2, 0x4, 0x7, 0x7fffffff, 0x10001, 0x7f, 0x5, 0x5, 0x40, 0xffff, 0x5, 0x8, 0x6, 0xec, 0x7fffffff, 0x0, 0x9, 0x4, 0x3, 0xfff, 0x3ff, 0x401, 0x9, 0x9, 0x71c8, 0x25, 0x9, 0xfffffff8, 0x40, 0xf8c8, 0xe6fa, 0x80, 0x3ff, 0x6, 0x7, 0x0, 0x63c8, 0x3ff, 0xffff, 0x8, 0x2, 0x200, 0x1, 0x4, 0xbbc0, 0xe4f, 0x0, 0x10000, 0x0, 0xffff0000, 0x2, 0x91, 0x628, 0x0, 0x6, 0x1, 0xffffff2d, 0x8001, 0x1000, 0x5, 0x0, 0x4, 0xffff451a, 0x0, 0x80000000, 0x4, 0x8001, 0x0, 0x3, 0x101, 0xffff8001, 0x200, 0x9, 0x3, 0x5, 0x559, 0xa624, 0x0, 0x1, 0x5, 0x3, 0x5, 0x9, 0x6000, 0x6, 0xb465, 0xd4000, 0x7, 0x6, 0x5, 0x3, 0x5, 0x100, 0x1000000, 0x4, 0xfffffc01, 0x8, 0x7ff, 0xb2, 0x4, 0x101, 0x6, 0xffffff7f, 0xfff, 0x5, 0x80000001, 0x31, 0x40, 0x200, 0x401, 0xff, 0x20, 0x4, 0x7fffffff, 0x6, 0x6, 0xffff890e, 0x7, 0x8, 0x2, 0x702, 0xf37, 0x888, 0x1000, 0x686c91b1, 0x7, 0x3, 0x5, 0x7404eb2d, 0x1, 0x5, 0x6, 0x3, 0xfffffeff, 0x2, 0x2e09, 0x200, 0xfff, 0x0, 0x0, 0x8, 0x6, 0x5, 0x4, 0x8, 0x3f74, 0x1ff, 0x400, 0x1, 0x3, 0x3, 0x81, 0x0, 0x1, 0xc0a, 0x80000000, 0x401, 0xffffffff, 0x77, 0x8000, 0xfffffe00, 0x2, 0xd8, 0x2, 0xffff, 0x4, 0x4, 0x6, 0x9, 0x180000, 0x80, 0x5, 0x7, 0x7, 0x2, 0x6, 0x0, 0x101, 0x9, 0xc402, 0x0, 0x0, 0x80000001, 0x3, 0x0, 0x7, 0x4, 0x4, 0x1ff, 0x7, 0x80, 0x7ff, 0x3, 0x7, 0x1, 0x4, 0x761, 0x3, 0xf4, 0x4, 0x100, 0x7f, 0x7f, 0x4, 0x7, 0x2, 0x0, 0x5, 0xc914, 0xfffffe00, 0x1ff, 0x1000, 0xf753, 0x4, 0x4, 0x7ff, 0x5, 0x8000, 0x519, 0x7, 0xa97, 0x7, 0xe126, 0x5000000, 0x2, 0x2, 0xa008, 0x1, 0x29cd, 0x3, 0x80000001, 0x7, 0x20, 0x0, 0x7, 0x0, 0x1ff, 0x3, 0x10001, 0x9, 0x8, 0x8, 0x782, 0x8bd4, 0x7fffffff, 0x5, 0x2856, 0x6, 0x7, 0x4, 0xa34, 0x2, 0x80000000, 0x4, 0x57, 0xed, 0x7, 0x8, 0x4, 0x0, 0x6, 0x3, 0x9e57, 0x2, 0x4, 0x46, 0x9, 0x7, 0x8, 0x3ff, 0x1, 0x1, 0x5, 0xfffffda7, 0x2, 0x6, 0x200, 0x0, 0x0, 0x6, 0xffffff01, 0x8, 0x2, 0x3, 0xffff, 0xf7, 0x5, 0x3, 0x6, 0x3, 0x4, 0x10000, 0xfff, 0x3ff, 0xe30b, 0xd976, 0x3ff, 0x9, 0xbc, 0x3ff, 0x9, 0x2, 0x4, 0x4, 0x100, 0x1c, 0x7, 0x5, 0x4, 0xd609, 0x0, 0x3ff, 0x80000000, 0x20, 0x2, 0x1, 0x4, 0x0, 0x9, 0x3c5, 0x3, 0xf3c, 0x9, 0xb7f, 0x6, 0x8, 0x1, 0x9, 0x7, 0x5, 0x1000, 0x7, 0x0, 0x1, 0x1, 0x9, 0x22ae1d, 0x9, 0x6, 0x7, 0xffff, 0x7, 0x7f, 0xd97, 0x3, 0xd5, 0xffffff93, 0x88, 0x8a, 0x3, 0x6, 0x3, 0x5, 0x0, 0xe5, 0x3f, 0x3, 0x8, 0x3e3e, 0x3ff, 0x0, 0x5f41, 0x1, 0x80000000, 0x145d, 0x6a8c, 0x7fffffff, 0x2, 0x6, 0xba2a, 0x5, 0x26, 0x9, 0x7f, 0x9, 0x80, 0x3ff, 0x3, 0x1ce, 0x5b, 0x20, 0x54, 0x4, 0x3, 0x800, 0x3, 0x80000000, 0x1, 0x1ff, 0x40, 0x8, 0x9, 0x7ff, 0x1ff, 0x4, 0x10000, 0x14, 0x6, 0x80000001, 0x2, 0x10001, 0x4, 0x800, 0x3, 0x3, 0x200, 0x400, 0x2f19, 0x1, 0x4, 0x1, 0xffff, 0x6, 0xa83, 0x7, 0x1, 0x1, 0x9, 0x81, 0x9, 0x9, 0x7, 0x7, 0x6, 0x8, 0x10000000, 0x3, 0xf2, 0x400, 0xfffffff7, 0x400, 0x20, 0xed, 0x0, 0x2, 0x9, 0x5, 0x5, 0x5, 0x9, 0x4, 0x3, 0x8001, 0xfede, 0x6, 0x0, 0x3, 0xab6e, 0x8, 0x401, 0x7, 0x6, 0x4, 0xb1, 0x2, 0x1000, 0x0, 0x81, 0x9f, 0x80, 0x5, 0x40, 0x782, 0x4, 0x87b8, 0x4, 0x4, 0x2, 0x0, 0x5, 0x5, 0x5, 0x7, 0x5, 0x21c00, 0x9, 0xffffffc0, 0x0, 0x9, 0x7, 0x2, 0x800, 0x3, 0x80000001, 0x7, 0x7, 0x4, 0x5, 0x6, 0x80, 0x4, 0xb2, 0x9, 0x12, 0x7fff, 0x4, 0x101, 0x6, 0x3ff, 0x401, 0x4fab, 0x10, 0x8, 0x5, 0x1f, 0xe77, 0x0, 0x8000, 0xffff, 0xfffffffd, 0x9, 0x3, 0x80000001, 0x4, 0x5b0b1085, 0x3, 0x5, 0x8, 0x18, 0x1, 0x911, 0x0, 0x9, 0x0, 0x6, 0x6, 0x8, 0x1, 0x2, 0x400, 0x8, 0x8, 0x8, 0x5, 0x200, 0x100, 0x2, 0x6, 0x10000, 0x8, 0xffffffc0, 0x5, 0xe96d, 0x0, 0x800, 0x3, 0x34c1, 0xf4e1, 0xffffffe1, 0x7f, 0x1ff, 0x2, 0x400000, 0x9, 0x1, 0xfff, 0x1, 0x100, 0xd0, 0x9, 0x80000001, 0x0, 0x2, 0xffff, 0x8, 0x3, 0x7ff800, 0x28000, 0x0, 0xfffffff7, 0x3, 0x8000000, 0x20, 0x7, 0x100, 0x8, 0x9, 0xfffffffb, 0x80000001, 0x6d, 0x1ff, 0x33, 0xa3, 0x100, 0xfff, 0x1, 0x1e4, 0xfffffffe, 0x6b, 0x7, 0x4, 0x2, 0x101, 0x10001, 0x18e8120e, 0xad, 0x1, 0x8, 0xffffffc0, 0x8, 0x7fff, 0xffff, 0x6, 0x2, 0xe78, 0x1, 0x938, 0x100, 0x4, 0x7, 0x4, 0x4, 0x8000, 0x3e00, 0x8, 0x8, 0x9, 0xc86f, 0x8, 0x8, 0x8001, 0x4, 0xfffffff7, 0x1ff, 0xff, 0x9, 0x4, 0x1, 0x4, 0xa74, 0x4, 0x9, 0xec1, 0x612, 0x5dc1, 0x3, 0x3, 0x7fff, 0x10001, 0x7f, 0x9, 0xfffffff9, 0x7, 0x7f, 0x60, 0x6, 0x9, 0x4, 0xffffffff, 0x0, 0x10000, 0x9, 0x0, 0x1, 0x3, 0x4, 0x1000, 0x2, 0x10000000, 0x7, 0x4, 0x8, 0x5a, 0x5, 0x1f, 0x3ff, 0x2, 0x7, 0x12, 0x0, 0x10001, 0x3, 0x200, 0x7, 0x81, 0x14, 0x7, 0x7, 0x401, 0xffffffff, 0x7, 0x7, 0xb86, 0x2, 0x20, 0x165, 0x4, 0x10000, 0x5efb, 0x2, 0xc91, 0x8000, 0x1, 0x0, 0x1000, 0x3f, 0x80, 0x8, 0x4, 0x80000001, 0x2, 0x7, 0x5, 0xfff, 0x2, 0x2, 0x9, 0x5d7cfb65, 0x7fffffff, 0x6, 0x10001, 0x58, 0x4, 0x7f, 0x80000000, 0x3ff, 0x7, 0x200, 0x0, 0xfffff2b6, 0x8001, 0x7, 0x0, 0x2, 0x6, 0x4, 0x400, 0x81, 0x1, 0x401, 0xc398, 0x40, 0x69b3fec7, 0x7, 0x6, 0x9, 0x1000, 0x4, 0x93, 0x101, 0x7f, 0x200000, 0x0, 0x7, 0x0, 0x1ff, 0x3, 0x9, 0x8, 0x7, 0x1, 0xff, 0xd47, 0x38eb2153, 0x200, 0x7, 0x81, 0x81, 0x80000001, 0xffffff67, 0x7fff, 0x6, 0x4, 0x2, 0x7f, 0x80, 0x5dc, 0xfe, 0x4, 0x57e, 0x0, 0x6, 0x2, 0x2816, 0x7, 0x1ff, 0x7825, 0x800, 0x80000000, 0x4, 0x6, 0x8, 0x3ff, 0x493, 0x5, 0x1, 0x8, 0x5, 0x43414486, 0x101, 0xa25c, 0x7, 0xfff, 0x7, 0x5, 0x401, 0x10000, 0x0, 0x9, 0x4, 0x4, 0x101, 0x1, 0x80000001, 0x5, 0x0, 0xff, 0x3, 0x456, 0x3, 0x6, 0x7fffffff, 0x0, 0x2d, 0x7ff, 0x2, 0x1f, 0x9b, 0xffff, 0x2, 0x9, 0x1, 0x8c6, 0x5, 0x4, 0x7fffffff, 0x3, 0x8, 0x10001, 0x7, 0x8, 0x6, 0x59f8, 0x1000, 0x3f, 0x100, 0x10001, 0x5, 0x0, 0x6, 0x4, 0x4, 0xfffffffb, 0x742, 0x7ff, 0xfff, 0x1, 0xffffffc0, 0x20, 0x8, 0x0, 0x5, 0x10000, 0x0, 0x4, 0x5, 0x3, 0x7, 0x0, 0x1, 0x1000, 0x7ff, 0x656, 0x9, 0x800, 0x0, 0x90400000, 0x7ff, 0x40, 0x2, 0x3, 0x4, 0xa9, 0x6, 0x8, 0x2e, 0x3, 0xff, 0x7000000, 0x2, 0x6, 0x1f, 0xcae, 0x7, 0x7, 0x7fff, 0x4, 0x0, 0x0, 0x5, 0x52, 0x3fe, 0xfffff000, 0x0, 0x2, 0x9, 0x3, 0x7, 0x8a57, 0x2, 0x4, 0x2, 0x800, 0x3f, 0x0, 0x2, 0x1f, 0x5, 0xedf4, 0x9e01, 0xa15, 0x88, 0x3ff, 0x644240b, 0x0, 0x8, 0x3f, 0xfff, 0x80000000, 0xed3b, 0x0, 0xdc, 0x81, 0x7ff, 0x7, 0x3, 0xff, 0x4, 0x4, 0xffffffc0, 0x6911, 0x4, 0x200, 0x3, 0x8001, 0x3, 0xda10, 0xe68, 0x0, 0x5, 0x0, 0x0, 0x7f, 0x6, 0x4, 0x1f, 0x5, 0x80, 0x7, 0x6, 0x3c228c61, 0xfff, 0x3, 0x7456, 0xdaf, 0x0, 0x8000, 0x4, 0x5, 0x80000001, 0xdaa9, 0x3, 0x101, 0x100, 0x0, 0x1, 0x4, 0x2, 0x1, 0x3f, 0xfffffffd, 0x200, 0x4, 0x1000, 0xda5a, 0x3, 0x1, 0x3, 0x3, 0x80, 0x7, 0xffffffff, 0x15e2, 0xf0000000, 0xffff, 0x1, 0x6, 0x7, 0x0, 0x7b, 0x0, 0x1000, 0x1, 0x54, 0x6, 0x6e1e1bc, 0x1, 0x3, 0x1, 0xffffffff, 0x3, 0x2, 0x1, 0x89c], 0x5, 0x400, 0x22, 0x7fff}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x2004c091}, 0x8000010) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x300, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044010}, 0x4000) openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0x81, {0x1, 0xc43, 0xff, 0xffff, 0x6, 0x9}}) 00:50:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x3}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x100}]}, 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) [ 508.022234] binder: 2990:3019 ioctl c018620c 20000040 returned -22 [ 508.042327] binder: 2990:3019 unknown command 1074290947 [ 508.059509] binder: 2990:3019 ioctl c0306201 20000800 returned -22 00:50:18 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x1}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, 0x13, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="03b20840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 5: r0 = socket(0x26, 0x5, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8000}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xd4}, 0x22000080) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1b0a35cef14ef0c}, 0xc, &(0x7f0000000340)={&(0x7f0000000140)={0x1fc, 0x7, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_EXPRESSIONS={0x1e8, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, [@tunnel={{0xb, 0x1, 'tunnel\x00'}, @void}, @hash={{0x9, 0x1, 'hash\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xffffffc1}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x5}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x7fffffff}]}}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x8}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}}]}, {0x134, 0x1, 0x0, 0x1, [@match={{0xa, 0x1, 'match\x00'}, @void}, @nat={{0x8, 0x1, 'nat\x00'}, @void}, @queue={{0xa, 0x1, 'queue\x00'}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0xd}, @NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0xd}, @NFTA_QUEUE_FLAGS={0x6, 0x3, 0x1, 0x0, 0x7}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x8}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x7}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0x401}, @NFTA_QUEUE_FLAGS={0x6, 0x3, 0x1, 0x0, 0x1}]}}, @cmp={{0x8, 0x1, 'cmp\x00'}, @void}, @numgen={{0xb, 0x1, 'numgen\x00'}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x9}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xed160ceeb5b2fea4}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0xd159fe85f54c8b3a}]}}, @osf={{0x8, 0x1, 'osf\x00'}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_OSF_TTL={0x5, 0x2, 0x8}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x73762b09a0aa8676}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_OSF_TTL={0x5, 0x2, 0x80}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xe3bcfa0bc765a543}]}}, @hash={{0x9, 0x1, 'hash\x00'}, @void}, @osf={{0x8, 0x1, 'osf\x00'}, @void}, @dynset={{0xb, 0x1, 'dynset\x00'}, @void}]}, {0x50, 0x1, 0x0, 0x1, [@rt={{0x7, 0x1, 'rt\x00'}, @void}, @queue={{0xa, 0x1, 'queue\x00'}, @void}, @synproxy={{0xd, 0x1, 'synproxy\x00'}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x7}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_SYNPROXY_FLAGS={0x8}]}}, @match={{0xa, 0x1, 'match\x00'}, @void}]}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x8001}, 0x4000080) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_destroy(0x0) 00:50:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0xfc, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ff}, @CTA_EXPECT_TIMEOUT={0x8}, @CTA_EXPECT_TUPLE={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private=0xa010101}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x230840, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000380)={'syzkaller1\x00'}) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000300)="48d32dca5ea0625bae3636bff8929628587562f786fabc9a18e1d86330e543dc32e4680af8a064e2df4925cb1ea9cd6456212dd0bf30e2caa49dc4c5769c6119d338498d") sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x10ff, 0x779, 0x4, 0x1], 0x4, 0x81000}) ioctl$UI_DEV_DESTROY(r5, 0x5502) 00:50:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0xc080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x7f}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xde}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000800}, 0x48000) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x80, 0x1, 0x2, 0x5, 0x0, 0x0, {0x3, 0x0, 0x2}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x3}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_NAT={0x50, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x30}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_MASK={0xc, 0x3, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x48000}, 0x20004880) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, r6, 0x100, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40100}, 0x80) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_destroy(0x0) 00:50:18 executing program 5: openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) socket(0x26, 0x5, 0x0) 00:50:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000000)={{@hyper, 0x1}, 0xca81, 0x800, 0x0, 0x1}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$getown(r1, 0x9) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x402) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r3, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xc, 0x0, &(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r3], 0x0, 0x0, 0x0}) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004051}, 0x0) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x3) 00:50:18 executing program 0: clock_gettime(0x3, &(0x7f0000000080)) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r0, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xa3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x643a533f0e8e5529) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000240)) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x4080, 0x0) openat$cgroup(r3, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000010) io_destroy(0x0) 00:50:18 executing program 5: socket(0x21, 0x5, 0x0) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, ["", "", "", "", "", "", "", ""]}, 0x9}, 0x1, 0x0, 0x0, 0x8001}, 0x4048050) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1900010}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x54, 0x20, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7f}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0x8000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x1, 0x5b171c9e85e014ce, 0x2) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000380)={&(0x7f0000000240), 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="a6000000", @ANYRES16=0x0, @ANYBLOB="00042abd7000fcdbdf25180000007c00258014000400d72219218f2e40bfcf314dc50008abc824000300a52b510de058efc04e4430e8e9603dfc55f2acf039f2a43716baba828f2678b305000200050000000500020081000000050002001f0000000c00018008000400020000000500020002000000140004002582b9a206e8a63ec51ddd9434b2ec520c0006000300000003000000"], 0x9c}, 0x1, 0x0, 0x0, 0x40004}, 0x48004) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:18 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="140429bd7000fbdbdf251100000008000300", @ANYRES32=r2, @ANYBLOB="0800030080e2f0adad29c5f320831c9da6e39b09c99b1aef3fab9b803b9d15f5370efa9cb4b7c0aa46e3aa2c6bcaf25afeb4f78803dbd39f50a7a58d3fd54165bdceb0c2e6806da43efcf41b20bdfd5e35147b6d324d2f0332857f927b6ae37528485407da6432f756049a41a507f2a371e7a51721b00625ffc4a5c1d0abd5b35009ba63a5c7b2ac9f889b5cde4455c505f674f6f10d21a2c7aca97ccd1a54b81560ff02ca216d66ab9bef307d73a60c57d282ea4e97a646803df8f05a389996c9cb5782b65a31e97e08c86ebef07f62ea13315412a3bf50b010098687f41a524641d5fa9b21aacb363949c851a21dc8ff8484923b423a88b64287d631bda4275d6dbcc31165c81387512e7c462e37a8c2a8074646cfcbecd960e4321304b8b4257fee6236895c7d3d2a327bc20b2b57b59bd32369d54f5906f560b0ed183dd3fdfe3ad1dcb30d8a686a037c05351e2b1a989e3ede7fce5b2a0e767f38174c0307186857ce6aaf123880d20deb6288cfd5ea619590c280", @ANYRES32=r3, @ANYBLOB="050012000000000008000300", @ANYRES32=r4, @ANYBLOB="0500120043000000"], 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, 0x0, 0xe04480691a7d1bcf, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}]}, 0x68}}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:18 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r3) [ 508.383557] binder: 3065:3084 unknown command 808482864 00:50:18 executing program 5: socket(0x4, 0x2, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) mmap$perf(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x20010, r0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001280)={0x44, 0x0, &(0x7f0000001100)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001040)={@ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/4096, 0x1000, 0x4, 0x2}, @fda={0x66646185, 0x6, 0x1, 0x15}, @fda={0x66646185, 0x6, 0x0, 0x21}}, &(0x7f00000010c0)={0x0, 0x28, 0x48}}}], 0xc7, 0x0, &(0x7f0000001180)="757b37c4f523c9c6405382b2f2c7031a58428e4035c38b9abf6eac7fa0745e870d523407e7b39730568d925e62ab6ab64fafeb88b37b6d5b9e7fede397921f528e18b8c3b893e5da372862f8c6df27d70f3b6a833a1437c124782a768582c43ad02f5de5a1b1cd78353806f875e2db8e5a4ede023c62986bea048204318205d3c02e180f8ffe1240030c888319bc3e38f689b65164aa56b2ccc73f4309867ad89d31b5f5748fcc018b98d09b92bf9bce847f83cc482f44aa39ebdcbbc8af0c910aff15251eafc1"}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000001640)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001600)={&(0x7f0000001300)=ANY=[@ANYBLOB="f4020000100000082bbd7000fddbdf25fc0100000000000000000000000000000a0101020000000000000000000000004e2300044e210003000000a021000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000000000000000000000004d62b000000fc000000000000000000000000000000060000000000000007000000000000000000000000000000000000000000000000000000000000000100010000000000200f00000000000000040000000000000500000000000000ffff000000000000030000000000000080000000000000000700000000f0ffff0800000025bd7000003500000a000201290000000000000010000a002bbd700026bd7000010000001c00040002004e234e210000ff01000000000000000000000000000108001e0020a80000e1000800dd0008000109d500e71039f39d14e74e7198779d7760b9969f55187ca53b5b0af385604a1ceb323d22fbee482d29f49bcb77b4b4697e39d81ed26bff46e95eced96dbe06ea977c91de6711c9fe3224960e7dacbdd96fd9c083cfe702a3624dba01e9f9abe09dc8652f0ca3c76d905389ac7f51f50bde16be65d687c63bd2ecc31fc4bfbc4d9ab1990c3bbf62ef3ee2649a79d8bf8fabcda84d592d84391eb7008d3d29655df824433fc7eee97b1afba3cb136904e8485d9415eda7888890fd055cc9f0c57ad1bee5b7ef97b5d115561813d18ebd7da11925e0c9eb2830000000e400060000000000000000000000000000000000200100000000000000000000000000014e21001f4e2100060a0020003c000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="ff020000000000000000000000000001000017d5ff000000fc0000000000000000000000000000004605000000000000000200000000000005000000000000000500000000000000040000000000000001e4000000000000ff7f0000000000000e330000000000001f00000000000000d2ffffff26eab36007000000000000000600000000000000a800000020000000050000002bbd700000000000000003f5100000000000000008000b0001000100"], 0x2f4}, 0x1, 0x0, 0x0, 0x20000000}, 0x5884) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 00:50:18 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:18 executing program 2: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x1ff) r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='io.stat\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/225, 0xe1, 0x0, 0x15}, @fda={0x66646185, 0x7, 0x0, 0xa}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}}], 0x0, 0x0, 0x0}) [ 508.427243] binder: 3065:3084 ioctl c0306201 200001c0 returned -22 00:50:19 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00'}) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x4, 0x70, 0x1f, 0xb5, 0x9b, 0x6, 0x0, 0xffffffff, 0x41004, 0xe, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0x200, 0x2}, 0x45000, 0x1ff, 0x3, 0x7, 0x8, 0xe1e8, 0xfffa}, 0xffffffffffffffff, 0xf, r1, 0x2) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000840)={0x2020}, 0x2020) 00:50:19 executing program 5: sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2700}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x80}]}, 0x24}, 0x1, 0x0, 0x0, 0x13b521fe5eb8953b}, 0x4000) socket(0x26, 0x5, 0x0) 00:50:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r2, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4840}, 0x20000000) 00:50:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x40002) io_setup(0x6, &(0x7f00000002c0)=0x0) io_submit(r1, 0x1, &(0x7f00000004c0)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) io_cancel(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x4, r2, &(0x7f0000000000)="56335d4015161c5d9c16666e9ab0019d7cedc5e574774505abaf8d3fef6d9943187deafe652cbd97e4121c507a55b9260c1f332236a9040d1fb515f17c4ea5bba4590ba28fa870ccce91c2ad4a2c2841052369ac3f71c3b2f7dd09e403405402eebb23d6d688c61f4ca384079e8fb4c6e4e7ab7808e4880e39242100f8950e077eed004e7394ae8bc1e8e899f78c65f2e1c51ce0968dfd3c9e6e58f25a265edd5a0a457e8c5b8cbeca59ade0bdda86e5e9df70b283c033de8772ee6ffa280576ae48dbf81a45cdbbac612d3b441d0fe70339b6419f07b3bc1bce917f", 0xdc, 0x6, 0x0, 0x3, r3}, &(0x7f0000000180)) r4 = socket(0x9, 0x0, 0x101) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200)='l2tp\x00', r2) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x64, r5, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xaeb5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x24008841) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 5: socket(0x26, 0x4, 0x400) 00:50:19 executing program 2: ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000040)={0xc, 0x1, {0x55, 0x21, 0x3, {0xcd, 0xffff}, {0x0, 0x3ff}, @rumble={0x2d, 0x2000}}, {0x53, 0x200, 0x1, {0x6, 0x1b}, {0x3, 0x5}, @cond=[{0x40, 0x81, 0x6, 0x4, 0x5, 0x8}, {0x8, 0x8, 0x20f7, 0x6, 0x5, 0xff}]}}) r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x1, 0x4) 00:50:19 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x100, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 5: socket(0x25, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00', r0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xffffffffffffff93, 0x0, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="d273db9d156fdbf2f5ef15966951013d31975c9f05cad7aad13dbbe1c8eff71a6cb48514410ca1d07026844e412a3ddcb23732f70cf4874f65c79590f1542b1e1c92506d5de08fc95ea2902ae139ca69628d2167b19fde69b65b4ed2b3b19414b5e2d7971747293cd0769096258eed3d4cf15bfc8ac2c691aa2dc98bfcb6a980ff2966b747e1c599b341dd3f8676ca38a544d7105754d8ed00e9b7c28b5905287ec376add0359b89ac16280cd3ed0143d9b9111945dd7c412f7cb8cd8e3fc52de9eb", @ANYRES64=r0, @ANYRES64=r1, @ANYRESOCT=r2], 0x0, 0x0, 0x0}) 00:50:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$OSF_MSG_ADD(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000040)={&(0x7f0000000680)={0x964, 0x0, 0x5, 0xc00, 0x0, 0x0, {0x0, 0x0, 0x5}, [{{0x254, 0x1, {{0x2, 0x10001}, 0x1, 0x2, 0x72, 0x1ff, 0x23, 'syz1\x00', "53d0d2a310ebb8c33960558db0cc3f457232fc610ed8d5843d430c6770f536e9", "aaac9f0d64377aa34dbed5d3d3bfce3fce4cd3722527f3cdf970a6c12f187f04", [{0x200, 0x3, {0x2, 0x4}}, {0x3ff, 0x9, {0x2, 0x1ff}}, {0xfffd, 0x74, {0x1, 0x9}}, {0x3, 0x4, {0x2, 0x5}}, {0x2, 0x401, {0x3, 0x1f}}, {0x401, 0xff80, {0x0, 0x1000}}, {0x6, 0xfffb, {0x2, 0x207}}, {0x3, 0x5581, {0x0, 0x4}}, {0x7, 0x0, {0x0, 0x3}}, {0x7ff, 0x1, {0x3, 0x1}}, {0x1, 0x9, {0x1, 0x2}}, {0xffff, 0x5, {0x0, 0x4}}, {0x7c, 0xfad3, {0x1, 0x4}}, {0x2, 0x2, {0x1, 0x6a5}}, {0x8001, 0x2, {0x3, 0x7}}, {0x0, 0x5, {0x1, 0x4}}, {0x4, 0x7, {0x3, 0xfffffff7}}, {0xe272, 0x3, {0x3, 0x80000000}}, {0xff, 0xee13, {0x3, 0x8000}}, {0x7, 0x9, {0x37fdcecce7c6b74, 0x96c}}, {0x3f, 0xffff, {0x3, 0x8}}, {0x4, 0xfff7, {0x0, 0x2}}, {0x6, 0x3, {0x1}}, {0xfffd, 0x7, {0x0, 0x7f}}, {0x4, 0x1, {0x3, 0xae1}}, {0x8000, 0x7, {0x2, 0x3}}, {0x7, 0x9f28, {0x2, 0xffff7967}}, {0x2, 0x2, {0x3, 0x5}}, {0x0, 0xffc0, {0x3, 0x2}}, {0x9, 0x7fff, {0x1, 0xe65}}, {0x2, 0xfbff, {0x2, 0x2}}, {0x7, 0x4, {0x2, 0x5}}, {0x7ff, 0x80, {0x3, 0x8}}, {0x0, 0x6, {0x1, 0x8001}}, {0x2, 0x4, {0x1, 0x1}}, {0xfffa, 0x8, {0x0, 0x2}}, {0xb04c, 0x400, {0x0, 0x9}}, {0x0, 0x9, {0x3, 0x1f}}, {0xe000, 0xffff, {0x0, 0x3}}, {0x9, 0xffff, {0x3, 0x5}}]}}}, {{0x254, 0x1, {{0x3, 0xf80}, 0x9, 0x7, 0x3, 0x5, 0xb, 'syz1\x00', "39415c500f6bc42f86fb0595f388834a12c4567d75936167ad8e1233b320c26c", "f4313e6f541122c6574dd32ccde619bbc55280c8f86d5e8ae5d954a97c8b5577", [{0x2, 0x5, {0x1, 0x3}}, {0x1, 0xa99e, {0x0, 0x4}}, {0x2, 0x5, {0x3, 0xfff}}, {0x6, 0xfe01, {0x0, 0x80000000}}, {0x9e5f, 0xff00, {0x0, 0x4c7}}, {0x77d3, 0x4, {0x2, 0x101}}, {0x8bf, 0x80, {0x3, 0x7f}}, {0x64, 0x8, {0x3, 0xb73}}, {0x7, 0x5, {0x3, 0x5}}, {0x35, 0x100, {0x3, 0x7f}}, {0xba00, 0xdca2, {0x0, 0xfffff801}}, {0x1000, 0x2, {0x3}}, {0x4, 0x8, {0x2, 0x8001}}, {0x1, 0x8, {0x0, 0xfff}}, {0x9, 0x81, {0x1, 0x8}}, {0x0, 0x9, {0x0, 0x4}}, {0x3ff, 0x9, {0x1, 0x8}}, {0x4, 0x9, {0x1}}, {0x5, 0x86, {0x0, 0x2}}, {0x9d6, 0x7, {0x0, 0xffffffff}}, {0x8, 0x3, {0x2, 0xffff}}, {0x591, 0x8, {0x0, 0x5}}, {0x0, 0x6, {0x1, 0x8}}, {0x7f, 0x400, {0x1, 0x2}}, {0x31, 0x401, {0x3, 0x8}}, {0x2, 0xba23, {0x0, 0xffff3fea}}, {0x4, 0x2, {0x0, 0xffffffff}}, {0x1, 0x7fff, {0x3, 0x8}}, {0x9, 0x80, {0x3, 0x8}}, {0x2, 0x8000, {0x0, 0x3}}, {0x8, 0x8, {0x3, 0x99}}, {0x8, 0x2, {0x0, 0x7}}, {0x48, 0x69b, {0x2}}, {0x0, 0xded0, {0x0, 0x1}}, {0x1f, 0x7f, {0x3, 0x3}}, {0x1, 0x7ff, {0x0, 0x1}}, {0x6, 0x7, {0x0, 0x851f}}, {0xa73c, 0x7, {0x2, 0xf0}}, {0x4, 0x5, {0x0, 0x6c5}}, {0x4, 0x7f, {0x0, 0x101}}]}}}, {{0x254, 0x1, {{0x1, 0x3ff}, 0x0, 0xe2, 0x92b, 0x400, 0x1a, 'syz1\x00', "0d89d09aaf8117e348031860f8d0bbc802a4ebcf38e6d71a0ea24d6589bf830a", "1ad2432ec493914816ab15d299f890b0c215f70e1ed8e2b3483fb60f487ccb0f", [{0x101, 0x8001, {0x3, 0x8001}}, {0x1ff, 0x1, {0x0, 0x8}}, {0xff00, 0x101, {0x3, 0x8}}, {0x97f9, 0x81, {0x0, 0x5}}, {0x1ff, 0x607a, {0x1, 0x37d}}, {0x2, 0x5, {0x2, 0x6}}, {0x9, 0x2, {0x3, 0x41b}}, {0x401, 0x7ff, {0x1, 0x5}}, {0x9, 0x1f, {0x0, 0x1}}, {0x0, 0x7, {0x3, 0x7}}, {0x6fa, 0x4, {0x3, 0xdbb9}}, {0x540b, 0x1, {0x0, 0x8}}, {0x9, 0x6, {0x0, 0x7}}, {0xf549, 0x6, {0x3, 0x5}}, {0xfff, 0x4, {0x3, 0x1}}, {0x8, 0x5, {0x1, 0x6}}, {0x4, 0x9, {0x2, 0x7fff}}, {0x1, 0x757, {0x1, 0x5}}, {0x84ea, 0x6, {0x0, 0x7}}, {0x9d, 0x9, {0x0, 0x5}}, {0x80, 0x8000, {0x2, 0xccc}}, {0x6, 0x3, {0x3, 0xfffffffb}}, {0xfff8, 0x5, {0x3, 0xd480}}, {0x0, 0x1000, {0x0, 0x40}}, {0x0, 0x0, {0x2}}, {0x0, 0xff}, {0x4, 0x2, {0x1, 0x5}}, {0x3, 0x8000, {0x1, 0x9}}, {0x563, 0x3ff, {0x3, 0x75}}, {0x89, 0xff2b, {0x2, 0x5}}, {0x6, 0x1, {0x0, 0x3ff}}, {0xa79f, 0x5bbb, {0x2, 0x20}}, {0x91, 0x3ff, {0x1, 0x1}}, {0x5, 0x0, {0x3, 0xc0}}, {0x1, 0xbaf, {0x1, 0x5}}, {0x0, 0x0, {0x0, 0x101}}, {0x6, 0x99a, {0x2, 0x3}}, {0x8, 0x3f, {0x1, 0x6}}, {0xead, 0x8001, {0x2}}, {0x4, 0x1, {0x3, 0x3f}}]}}}, {{0x254, 0x1, {{0x1, 0xbd}, 0xd, 0x2, 0x100, 0x0, 0xe, 'syz1\x00', "9011298006b59eae4a2c045de16274f70368e47f362da451b128bed3cef4d3f8", "ca8d533c8b7b5373c810b1f2b8b42bd36aeb1d7f068873037e034ef2f440d7a4", [{0xfff9, 0x2, {0x2, 0x8}}, {0x2, 0x3ff, {0x1, 0x300000}}, {0x1f, 0x9, {0x2}}, {0x3, 0x2, {0x1, 0x3}}, {0x0, 0x1f, {0x1, 0x9}}, {0x8, 0x2, {0x1}}, {0x7, 0x1ff, {0x0, 0x4}}, {0x9, 0x5, {0x1, 0xfffff22d}}, {0x1, 0x7ff, {0x2, 0x48}}, {0x8, 0x9, {0x2, 0x400}}, {0x400, 0x8001, {0x1, 0x6}}, {0x9, 0x8001, {0x3, 0x7}}, {0x9, 0x4, {0x1, 0x8}}, {0xffff, 0x8, {0x2, 0x4}}, {0x193, 0x1f, {0x1, 0x7}}, {0x3, 0x1, {0x0, 0x3}}, {0xdbe, 0xffcc, {0x2}}, {0x2b, 0xb057, {0x3, 0x7}}, {0x8000, 0x9, {0x1, 0x3f}}, {0x20, 0x2, {0x3, 0x4}}, {0x9, 0x5, {0x2, 0x8}}, {0x0, 0x2, {0x0, 0x2}}, {0x8000, 0x6, {0x0, 0xfff}}, {0x800, 0x6, {0x2, 0x4}}, {0x5, 0x0, {0x3, 0x4}}, {0x2, 0x3, {0x59a59183735b3bc4, 0x7fffffff}}, {0x1, 0x3f, {0x0, 0x8}}, {0x4, 0x6, {0x3, 0x10001}}, {0xffe1, 0x0, {0x3, 0x7fffffff}}, {0xc75, 0x0, {0x3, 0x1f}}, {0x1, 0x6a, {0x3, 0x9}}, {0x3ff, 0x9, {0x2, 0x1}}, {0x5, 0x3, {0x3, 0x4}}, {0x81, 0x7, {0x0, 0x9}}, {0x1f, 0x1, {0x2, 0x9}}, {0x8, 0x0, {0x1, 0x9}}, {0x7fff, 0x7, {0x1, 0xffffffff}}, {0x1, 0x2, {0x0, 0x52}}, {0x2c07, 0x3, {0x1, 0x5b7}}, {0x4, 0x7, {0x1, 0x10001}}]}}}]}, 0x964}, 0x1, 0x0, 0x0, 0x80}, 0x4) 00:50:19 executing program 1: getresuid(&(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000080)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000040)=0x10000) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:19 executing program 3: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 5: sendto$l2tp6(0xffffffffffffffff, &(0x7f0000000000)="e6091968022fd228c08a111e04dc1ca296b49a8fcbdd5db0e030a9a8c570f09f745605f2a8756b690ae77ef6b89230d21884faaeab7801fe8a121424bb81b40086aa0f0a30438308ec78aeca06d24f3143afb4ab0c2ca7d453e296f14f0b36caaadd6dd88cdd2ac356ff8c13a3708822fe5102a6a85c5eea99906ea85a08c40ff7d020e2b255ba03ce97d2dba72b5d1d21d5d593d9e7dcf68036a4d60473", 0x9e, 0x24000884, &(0x7f00000000c0)={0xa, 0x0, 0xc0000000, @loopback, 0x0, 0x1}, 0x20) socket(0x15, 0x3, 0xfffffffe) 00:50:19 executing program 1: io_setup(0x7, &(0x7f0000000000)=0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x0, 0x0) io_cancel(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7e, r1, &(0x7f0000000040)="faace052c1a4cf9c42d8d517f4eae3f5f2e07b8fcd248dc3ce2f5350bf7ad86f3ae30567bce152cb81d2c8a6199ab9b627915fd38609c3f8", 0x38, 0xc75, 0x0, 0x3, r2}, &(0x7f0000000100)) io_setup(0xfffffffd, &(0x7f0000000140)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:19 executing program 0: getpid() r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="3b05e39cf8f5ddf0a449bc9a5391a2432a67516da4b3145e41acbea0c681f28dc8ba5977de3e8c8413d398e0746914f0a05568754631402b124848edd1e8a22f7a252baf78aade403e759284c7fa4d263626473ec6709dfe32c8e00b2fa7ba47493ee014d3130e076c63677fa099d7287943c1a0f9fd542338dbc03a0c150e60898e1a4efb41daf16cdcfeca3f9f572e086a5c7f9e64eb1ed6060348c9285e17c4c65a1c4128daad5146838c7136920a098e705d4448600fb40000000000007eb50626fb5300000000000000000000000000001bf957cb3b64d8e3a1d3fee12f4a74", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 5: ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000090}, 0xc000) r3 = gettid() socket(0x22, 0x5, 0x0) r4 = gettid() getpgid(r4) r5 = getpid() r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan3\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = gettid() r10 = syz_open_procfs$namespace(r3, &(0x7f0000000640)='ns/ipc\x00') sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r8, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x68, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PID={0x8, 0x1c, r9}, @NL802154_ATTR_PID={0x8, 0x1c, r4}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r10}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x814) sendmsg$NL802154_CMD_DEL_SEC_KEY(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000300)={0x244, 0x0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0xf0, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "23e83ed67202151748d985315d1d61aa791d913d136f3b9c8243f7f9129472b1"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "504f09c9d19ca3e96f88807d19cc9d9f"}, @NL802154_KEY_ATTR_ID={0x2c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x10, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x1f}, @NL802154_KEY_ATTR_ID={0x30, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5}, @NL802154_KEY_ATTR_ID={0x1c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}]}, @NL802154_KEY_ATTR_ID={0x2c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x100}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x80000000}]}]}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SEC_KEY={0xfc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "db05366153083e044c0a8ada0e9c19bb"}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "2ab257655bcc9a610451a8602e64d2929167e883f2f49111c02885c51bf164bc"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "6b02fe6afbad3b2726dac968afd93851"}, @NL802154_KEY_ATTR_ID={0xac, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x50, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x30, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0x5555555555540004}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x198}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x244}, 0x1, 0x0, 0x0, 0x8011}, 0x80) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r5}, {0x0}, 0x37bf, 0x9}) ioctl$DRM_IOCTL_GET_CLIENT(r6, 0xc0286405, &(0x7f0000000080)={0x401, 0x7, {r4}, {r11}, 0x4}) ioprio_get$pid(0x1, r4) 00:50:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r1, 0x100, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000050) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 3: io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x5c) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r6, 0x0, 0x0) ioctl$UI_SET_PROPBIT(r6, 0x4004556e, 0x12) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40088121}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, 0x0, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x7}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x84}, 0x1, 0x0, 0x0, 0x24040000}, 0x4000000) ioctl$UI_DEV_DESTROY(r0, 0x5502) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.stat\x00', 0x0, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x5855aba4df5ce234}, 0x80a0) [ 508.948369] binder: 3184:3188 unknown command -1662843589 [ 508.970802] binder: 3184:3188 ioctl c0306201 20000800 returned -22 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x10001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)={0x0, 0x4, 0x6, &(0x7f0000000000)=0x1000}) 00:50:19 executing program 5: socket(0x26, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 0: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x9d}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x8f1}]}, 0x64}, 0x1, 0x0, 0x0, 0x24000805}, 0x4000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:19 executing program 3: io_setup(0x0, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 00:50:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, 0x0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x7b}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000081}, 0x20000000) 00:50:19 executing program 5: r0 = socket(0x26, 0x5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)={0x1}) r1 = socket$l2tp6(0xa, 0x2, 0x73) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x0, 0x3, 0x2, 0x4, {0xa, 0x4e23, 0x200, @rand_addr=' \x01\x00', 0x1}}}, 0x32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xd303545542bf5137}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r3, 0x20, 0x70bd25, 0x7, {}, [@NL802154_ATTR_SEC_KEY={0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r2, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x200}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004000}, 0x40005) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r2, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x60}}, 0x90) 00:50:19 executing program 3: io_setup(0x0, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080027bd7000ffdbdf250400000008001800ffffffff06001c00040000000c000f0004000000000000000c001000ff0700000000000008000b000200000006000e00ff00000006001b004e240000050014000400000008001700", @ANYRES32, @ANYBLOB="855c16b7568c6616a0b9afc6b6b70b1d06860a032f0df1e7998a59df02db274317aa7c59020204b165d89b64b12ab132882fa23ee0a9d06fb7b457685f5340a3db8db9110c5f82ee0c266510619d8d6d11a8832c1608bffeabf6841d08e1324e73489cf7376b5cd89475e21725edc4ec13dde8474933ed4eb35735dbcdcb94e00bd0d154"], 0x64}, 0x1, 0x0, 0x0, 0x40}, 0x40008c1) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x1, 0x3, 0x9, 0x2, 0x200, 0x80000000], 0x6, 0x0, 0x0, 0xffffffffffffffff}) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, 0x7, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x60}]}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c8c0) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x5, 0x1, 0x24}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/124, 0x7c, 0x0, 0x40}, @fda={0x66646185, 0x0, 0x2, 0x29}}, &(0x7f0000000240)={0x0, 0x20, 0x48}}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:19 executing program 3: io_setup(0x0, &(0x7f0000000000)=0x0) io_destroy(r0) 00:50:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = getpgrp(0xffffffffffffffff) waitid(0x0, r1, &(0x7f0000000000), 0x2, &(0x7f0000000080)) socket(0x26, 0x5, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x14942d75d2cd0992, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000180)) r2 = gettid() getpgid(r2) r3 = getpid() r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='devices.list\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x7, 0x0, {r3}, {0x0}, 0x37bf, 0x9}) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000080)={0x401, 0x7, {r2}, {r5}, 0x4}) waitid(0x1, r2, &(0x7f00000001c0), 0x4, &(0x7f0000000240)) 00:50:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) write$vhost_msg(r1, &(0x7f0000000200)={0x1, {&(0x7f0000000040)=""/245, 0xf5, &(0x7f0000000140)=""/146, 0x1}}, 0x48) recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000400)=""/40, 0x28, 0x2120, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000340)={&(0x7f0000000300)=[0x0, 0x8000], 0x2, 0x0, 0x0, 0xffffffffffffffff}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000480)=0x0, &(0x7f00000004c0)=0x4) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0xa000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000800)=@allocspi={0x244, 0x16, 0x800, 0x70bd2c, 0x25dfdbfe, {{{@in=@private=0xa010102, @in6=@remote, 0x4e20, 0x5, 0x4e23, 0x3, 0xa, 0x80, 0x0, 0x33, r3, 0xee01}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2, 0x33}, @in=@broadcast, {0x7f, 0x3ff, 0x2, 0xfc7, 0x4984, 0x2, 0x1, 0x5}, {0xf66a, 0x9, 0x0, 0x6}, {0x5, 0x0, 0x7f}, 0x70bd25, 0x3500, 0x0, 0x4, 0x96, 0xe6}, 0x7f, 0x8}, [@algo_auth_trunc={0xbb, 0x14, {{'poly1305-neon\x00'}, 0x378, 0x80, "156587dbc9306da1f5a0f0831a01ca638048b867af98093c0945e67e1d13e578825741ba97c7647bc23f80b49c53c46c6a6f54ddab26f4203d51eb8ddf6abcef625e2eb3a4fd6c7fb2ca72cb6ad4f16b8d2d46cebe8abfb118ffe27578e7da838813db224302b89888c9c0b88debeb"}}, @algo_crypt={0x8e, 0x2, {{'ecb(des3_ede)\x00'}, 0x230, "4b9051a9ea2524a99e35c61764dd3ee9a5c0e0816cef1e10d0f4f7637d35c22788245f796219a270ed358abc3208b85635333497fbc56b65b5e930fc051d490b04a8aa2f9004"}}]}, 0x244}, 0x1, 0x0, 0x0, 0x40080}, 0x50) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r4, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="0000c151fae5f5567ee3540a4805754a285227c725aeb5380f54dcb59bdff57cfecfbc11150a244a6f1d0f4725dfa6480bd17c3fdbdbe18d9efe09444a83909ed2a5dbc667d4e1abd1aa1d1d7e828111b24b0b0cdaa07834ce61661fdf533c64adfd525092e8d9f22813fa96c767ddf1485adb6cee2aac98474fb8d3070051945275c1497f318cef52a4894f597844f96231e3e1c2e0a086842d8ab9944362e38ed1712a72c64dfcf8111fa8ad969055e21b26501dc6cb4e05d89c6aaab897009b33b12aef90243a4b7cd0715d8c87395729c028bc6bbe047019e4715a058c5187b9510349b2849a88fc513c086d233c06670ef0188575e485b9d7c6b02576", @ANYRES16=r5, @ANYBLOB="00052dbd7000fddbdf252e00000006000400a3aa000006000600010000000c0005000201aaaaaaaaaaaa0a0001007770616e3400000008002c0067fbffff05002b000100000006000400ffff0000"], 0x54}, 0x1, 0x0, 0x0, 0x24008044}, 0x20004800) 00:50:19 executing program 3: io_setup(0x3ff, 0x0) io_destroy(0x0) [ 509.310576] binder: 3241:3249 unknown command 0 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:19 executing program 3: io_setup(0x3ff, 0x0) io_destroy(0x0) [ 509.377575] binder: 3241:3249 ioctl c0306201 20000800 returned -22 [ 509.401057] binder: 3260:3264 ioctl c018620b 0 returned -14 00:50:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9a630800390841a128a8bc279302df9fb0a6338f6be5407763e814ce072a8ad83bef36a3b729ba1cb439d714885ca2ac3b71d3cd12027cca866dc5bc141c2f066d7db534c4d3911c3d7c51b1ec77a63efc2eb5771c0f29e30e2b58c4b77a2dd1afb8361996bb6fe2f1fa217ca67968733327c3ebb50a29", @ANYRES64=0x0], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x10001) 00:50:19 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:19 executing program 3: io_setup(0x3ff, 0x0) io_destroy(0x0) [ 509.449901] binder: 3260:3264 ioctl c018620c 20000180 returned -22 [ 509.482006] binder: 3260:3277 ioctl c018620b 0 returned -14 00:50:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4000041}, 0x24004000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80800) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) socket$nl_netfilter(0x10, 0x3, 0xc) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000100)=@updpolicy={0x378, 0x19, 0x1, 0x70bd2d, 0x25dfdbff, {{@in6=@ipv4={[], [], @broadcast}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, 0x4e21, 0x9, 0x4e24, 0x18f, 0x2, 0x0, 0x20, 0x29, 0x0, 0xee00}, {0x4, 0x10000, 0x80000000, 0x0, 0x4, 0x2, 0x10000, 0xff}, {0x0, 0xffffffffffffffe2, 0x1000100, 0x2}, 0x8, 0x6e6bb3, 0x0, 0x0, 0x3, 0x2}, [@user_kmaddress={0x2c, 0x13, {@in=@multicast2, @in=@empty, 0x0, 0x2}}, @algo_aead={0xe5, 0x12, {{'gcm(blowfish-asm)\x00'}, 0x4c8, 0x180, "a4aaf918edfd2c72407eb01973f7ef71fe6542eba182da2cfd9137abed74d56e55b4038702ca39a1e44b44a44cbc5c3c78c1da9407af5df83811b39cd8417a1df147f8d1d766607dafc46a04a2f1165fd27f0c5f13923b66986848d04307b38d092bd1e6477f70ca009a162eeaed8eb9665eb07645bcf2e502e60f692d1a794f50d4e2bc739a7e58e428b99680b3ae6c2fe5c2e886ee2ed5be"}}, @proto={0x5, 0x19, 0x33}, @policy={0xac, 0x7, {{@in=@dev={0xac, 0x14, 0x14, 0x14}, @in6=@loopback, 0x4e23, 0x6, 0x4e20, 0x68b, 0xa, 0x1a0, 0x0, 0x1, r2, 0xffffffffffffffff}, {0xff, 0x7, 0x8, 0x2, 0x7, 0x8000, 0x4, 0x7fffffff}, {0x8001, 0x3, 0x3a0, 0x5}, 0x0, 0x6e6bb6, 0x2, 0x1, 0x1}}, @replay_val={0x10, 0xa, {0x70bd25, 0x70bd27, 0x3c6b}}, @policy={0xac, 0x7, {{@in=@loopback, @in=@broadcast, 0x4e20, 0x7fff, 0x4e22, 0x1ff, 0xa, 0x20, 0xa0, 0x2c, 0x0, r3}, {0x7fff, 0x1, 0x2, 0x6, 0x6, 0x7f, 0x3, 0x1}, {0x1000, 0x2462e79c, 0xfffffffffffffffa, 0x3}, 0x1, 0x6e6bb9, 0x1, 0x0, 0x1, 0x1}}, @srcaddr={0x14, 0xd, @in6=@mcast2}, @encap={0x1c, 0x4, {0x3, 0x4e22, 0x4e21, @in6=@rand_addr=' \x01\x00'}}, @policy_type={0xa}]}, 0x378}, 0x1, 0x0, 0x0, 0x4000}, 0x404c885) socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000280)={0x4, 0xfffffffb, {0xffffffffffffffff}, {0xffffffffffffffff}, 0x9, 0x1}) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=@acquire={0x130, 0x17, 0x300, 0x70bd2d, 0x25dfdbfb, {{@in6=@ipv4={[], [], @empty}, 0x4d4, 0x5e}, @in=@multicast2, {@in=@private=0xa010101, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24, 0x9, 0x4e20, 0x0, 0x8, 0x0, 0xa0, 0x87, r2, 0xee00}, {{@in6=@dev={0xfe, 0x80, [], 0x34}, @in6=@mcast1, 0x4e21, 0x1000, 0x4e21, 0x0, 0x2, 0x20, 0x0, 0x33, 0x0, r3}, {0x1, 0x7, 0x8, 0x8000, 0x57, 0x57, 0x65b, 0x4}, {0x8, 0x8, 0xfffffffffffffffa, 0x1}, 0x3, 0x6e6bb9, 0x0, 0x0, 0x0, 0x2}, 0x3f, 0xc1ac, 0x1, 0x70bd28}, [@extra_flags={0x8, 0x18, 0x10000}]}, 0x130}, 0x1, 0x0, 0x0, 0x44000}, 0x4000) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xd4, 0x3, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x2}, @CTA_NAT_DST={0x34, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @local}, @CTA_NAT_PROTO={0x1c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}]}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xb, 0x1, 'amanda\x00'}}, @CTA_SYNPROXY={0x3c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x1}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xe52}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0xffff}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x3ff}]}, @CTA_NAT_DST={0x30, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @rand_addr=0x64010100}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @loopback}]}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}]}, 0xd4}, 0x1, 0x0, 0x0, 0x2000c805}, 0x10) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 509.523424] binder: 3279:3281 unknown command 549786 [ 509.533313] binder: 3260:3287 ioctl c018620c 20000180 returned -22 [ 509.552775] binder: 3279:3281 ioctl c0306201 20000800 returned -22 00:50:20 executing program 5: sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xc}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x40080) socket(0x26, 0x5, 0x0) 00:50:20 executing program 3: io_setup(0x3ff, &(0x7f0000000000)) io_destroy(0x0) 00:50:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) read$FUSE(r1, &(0x7f0000000680)={0x2020}, 0x2020) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 509.600178] binder: 3279:3281 unknown command 549786 [ 509.613060] binder: 3279:3281 ioctl c0306201 20000800 returned -22 00:50:20 executing program 2: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0xffffffff) r1 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630860dea47b0d1d99fc5df4fe999bd359c110e7161a55cc08ae76fe97ba2f20be57ac05d8c6a307844204c19a319d012de28fb7b7dc7da4fb00a03356111bfe954176095a3916dcb8d4903c399f6e6ec2dd92018312c5f344873656549d6e38ca69e84e730b83f67f924604c822179c297b03cdb6ec96555d3f7ecc1e47a54c18098f757d972b7e4258ce51a74aabef851fd89944603e559510b0004220c1551463a240871003a9284321f97a447cb4e7983d9a5d00ca735cbfd0faa4081b195713fe345163f9704ba4b5d186d4cc6c7137f005ff68b46bd4cb221939ac967388cf", @ANYRES64=0x0], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x81) 00:50:20 executing program 5: socket(0x26, 0x5, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x20183, 0x0) sendto$l2tp6(r0, &(0x7f0000000500)="16a788b45ecc0fe133201bd969790f0200c1a0195fcec3c3e8ca8ce8f7b3f0528b25e2a185f04f62f16c1291b16402438dca3da187dcf6440f2bbc3f6ac3c0e0f2e8c0ce618624f6cf985f1624ecbd9b21008e2888d6a0521c47d911299ca5bf54e21c7ece02b85f51404209f92952804a063ce46faf94700a6cd6e145fdaac63e84e2a01eb5139e4fbff18bff5d26d67d0d489b0cab5ff21f5b19b2921bb4940a2113af0486be09863e039545c679d93fdffda8cb689b147616", 0xba, 0x20000000, &(0x7f00000005c0)={0xa, 0x0, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7, 0x4}, 0x20) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, 0x0, 0x20, 0x4, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[], [], @broadcast}}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x81}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000010}, 0x4000000) socketpair(0x2a, 0x800, 0x80000001, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0x21}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000814}, 0x4000000) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x88, 0x1, 0x2, 0x301, 0x0, 0x0, {0x3}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xf3b}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_MASK={0x4c, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x30, 0x0, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x404c090) 00:50:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 3: io_setup(0x3ff, &(0x7f0000000000)) io_destroy(0x0) 00:50:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan0\x00'}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400d0}, 0x1) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="140429bd7000fbdbdf251100000008000300", @ANYRES32=r3, @ANYBLOB="08000300", @ANYRES32=r4, @ANYBLOB="050012000000000008000300", @ANYRES32=r5, @ANYBLOB="0500120043000000"], 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='pids.events\x00', 0x0, 0x0) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300)='l2tp\x00', 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, r7, 0x1, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x40800) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r2, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa1}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x200}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x20004040) 00:50:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0363c940", @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 509.739490] binder: 3307:3313 unknown command 1611162371 [ 509.762551] binder: 3307:3313 ioctl c0306201 20000800 returned -22 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 3: io_setup(0x3ff, &(0x7f0000000000)) io_destroy(0x0) 00:50:20 executing program 5: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r0, 0x7aa, &(0x7f0000000040)={{@local}, 0xffff, 0x7}) socket(0x26, 0x5, 0x0) [ 509.851087] binder: 3334:3335 unknown command 1086939907 [ 509.868415] binder: 3334:3335 ioctl c0306201 20000800 returned -22 00:50:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x20, 0x2) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) write$uinput_user_dev(r1, &(0x7f0000000840)={'syz0\x00', {0x5ad, 0x49, 0x9, 0x7f}, 0x3d, [0x7, 0x80000001, 0x1, 0x5d, 0xe000, 0x7f443777, 0x1000, 0x6, 0x8, 0xb3, 0x5, 0x3, 0x8000, 0x3ff, 0x31, 0x10000, 0x7ff800, 0x4, 0xfffffffb, 0x4, 0x80, 0xfffffffd, 0x2, 0xfffffffb, 0x3, 0x8, 0x4, 0x3ff, 0x6, 0x6, 0x3, 0x1, 0x7, 0x7f, 0xffff, 0x10000, 0x7ff, 0x7f, 0x3ff, 0x7f, 0x6, 0x837e, 0xffffffff, 0x7fffffff, 0x5, 0xfffffffa, 0x4, 0x1, 0x1f, 0x7fff, 0xffff, 0x8, 0xfffffffb, 0x9, 0x8, 0x3, 0xebc, 0x6, 0x7, 0x3, 0x4d, 0x1f5, 0x5, 0x1], [0x2, 0x0, 0x0, 0x4, 0x4, 0x8, 0x2, 0x7, 0x8, 0x6dfe, 0x5, 0x8001, 0x2, 0x8, 0x8, 0x7f, 0x7, 0x2, 0x6, 0x5, 0x50d, 0x1, 0x3ff, 0x90, 0x2, 0xff, 0x5, 0x8001, 0x2, 0xf11, 0x8001, 0x100, 0x6, 0x2, 0x3, 0x7, 0xe3, 0x1, 0x3ff, 0xffff0000, 0xd97, 0x4c548741, 0x400, 0x9, 0xffff, 0x2, 0x8, 0xfffffff7, 0x6, 0x1, 0x7e, 0x4, 0x8f5b, 0x0, 0x2a1, 0x9, 0x7, 0x8000, 0x101, 0x7, 0xa7, 0xdbe, 0x5, 0x20], [0x5, 0x1f, 0x200, 0x101, 0xd2d8, 0x2, 0x9, 0x6, 0x0, 0x64b937fe, 0x39, 0x6, 0x9, 0x4, 0x6294, 0xfffffff7, 0x5, 0x7ff, 0x7fff, 0x1ff, 0x1000, 0xffff, 0xd4, 0x1, 0xb27, 0x9681, 0x3, 0x8, 0xfa36, 0x200, 0x1, 0x7fffffff, 0x7, 0x5, 0x6, 0x6, 0x1, 0xd6, 0x6, 0x4, 0x4, 0xff, 0x0, 0x80000001, 0x10001, 0xba, 0x7, 0x3, 0x3ff, 0x7, 0x4, 0x46b, 0x0, 0xcc2b, 0x80000001, 0x0, 0x1000, 0x3f4, 0xfffff50c, 0x8, 0x5, 0x1f, 0x3ea7, 0x1d], [0x0, 0x5, 0x8000, 0xffff, 0x978, 0x2, 0x7ff, 0x1, 0xfff, 0x2, 0x8001, 0xffffffff, 0x6, 0x4, 0x2, 0x1, 0x883c, 0x4d1d, 0x1f, 0x7, 0x0, 0x7607, 0x7, 0x37f78b36, 0x0, 0x1, 0x9c19da0, 0x8, 0x7, 0xdac00000, 0x6b6, 0x7, 0x101, 0x9e0, 0x2, 0x1, 0x499, 0x200, 0x80000001, 0x8, 0xfffffffd, 0x401, 0x100, 0x7, 0x2, 0x3, 0x1ff, 0x3, 0x9, 0x4, 0x7fffffff, 0x0, 0x10001, 0x0, 0x80, 0x3f, 0x4, 0x80000000, 0x6, 0x9, 0x5b0e, 0x8, 0xfffffbff, 0xdc2]}, 0x45c) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000000)={0x4, 0x40007, {0xffffffffffffffff}, {0xee00}, 0x3, 0x9}) r2 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x129000, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000080)={0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x184, r2, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0x3c, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "ed8f00c4e6d3f007543c41ff918920f7"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xe}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "c1a58fa792ba21d6ddfe287dc4f3277f"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x1f}]}, @NL802154_ATTR_SEC_KEY={0xb0, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "0ddf9da55b45166b9927f09774f5de61d353b05f21712a065b93b54b5408d106"}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "f2e336c6ad1fb1b6f67b8bc71b405dd18d90565e8a5f6865c3d68fc3e892c629"}, @NL802154_KEY_ATTR_ID={0x34, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7fffffff}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "f3220645b7084e29326c16219815703f"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x4}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "4872eeddc88191f15fe826a5293950d5"}]}, @NL802154_ATTR_SEC_KEY={0x58, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x18, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x9}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "72400d6ab812fc9896f1598ff321a8bd"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "80138c0982f8dbe93f654f7dd4122133"}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x184}, 0x1, 0x0, 0x0, 0x10}, 0x0) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 5: socket(0x26, 0x5, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x501000, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xf9}]}, 0x1c}}, 0x24048814) connect$l2tp(r0, &(0x7f0000000040)={0x2, 0x0, @empty, 0x4}, 0x10) 00:50:20 executing program 3: socket(0x26, 0x5, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x20183, 0x0) sendto$l2tp6(r0, &(0x7f0000000500)="16a788b45ecc0fe133201bd969790f0200c1a0195fcec3c3e8ca8ce8f7b3f0528b25e2a185f04f62f16c1291b16402438dca3da187dcf6440f2bbc3f6ac3c0e0f2e8c0ce618624f6cf985f1624ecbd9b21008e2888d6a0521c47d911299ca5bf54e21c7ece02b85f51404209f92952804a063ce46faf94700a6cd6e145fdaac63e84e2a01eb5139e4fbff18bff5d26d67d0d489b0cab5ff21f5b19b2921bb4940a2113af0486be09863e039545c679d93fdffda8cb689b147616", 0xba, 0x20000000, &(0x7f00000005c0)={0xa, 0x0, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7, 0x4}, 0x20) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, 0x0, 0x20, 0x4, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[], [], @broadcast}}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x81}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000010}, 0x4000000) socketpair(0x2a, 0x800, 0x80000001, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0x21}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000814}, 0x4000000) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x88, 0x1, 0x2, 0x301, 0x0, 0x0, {0x3}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xf3b}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_MASK={0x4c, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x30, 0x0, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x404c090) 00:50:20 executing program 0: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:20 executing program 5: socket(0xb, 0x1, 0x100009) 00:50:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x20a042c, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno'}, 0x2c, {[{@access_any='access=any'}, {@cache_none='cache=none'}, {@afid={'afid', 0x3d, 0x9}}, {@fscache='fscache'}, {@dfltuid={'dfltuid', 0x3d, 0xffffffffffffffff}}, {@access_user='access=user'}], [{@obj_type={'obj_type', 0x3d, '/dev/binder#\x00'}}]}}) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000c00)={'wpan0\x00'}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040)='802.15.4 MAC\x00', 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400d0}, 0x1) 00:50:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180)='nl802154\x00', r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r2, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_LEVEL={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r1, 0x420, 0x70bd2b, 0x10001, {}, [@NL802154_ATTR_SEC_LEVEL={0x2c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xb0}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x10000}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000005}, 0x40000) 00:50:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={0x2}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000080)='syz0\x00') 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xffffffff7fffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x17}]}, 0x30}}, 0x5) 00:50:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x2, 0x3, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFQA_CFG_MASK={0x8}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x11}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x20}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x24}]}, 0x34}, 0x1, 0x0, 0x0, 0x480c}, 0x44) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r0, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x88, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_SEC_DEVKEY={0x30, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x2}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x400}, @NL802154_DEVKEY_ATTR_ID={0x10, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000880}, 0x0) r5 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@getsa={0xf4, 0x12, 0x20, 0x70bd2b, 0x25dfdbff, {@in6=@local, 0x4d6, 0x83b76d119ad8c2e9, 0x6c}, [@policy={0xac, 0x7, {{@in=@empty, @in6=@private0, 0x4e24, 0x2, 0x4e21, 0x379, 0xa, 0x80, 0x0, 0x4}, {0x0, 0x5, 0x1334, 0x0, 0x4, 0x100, 0x7fff, 0x9}, {0x401, 0xc8, 0xfffffffffffffffa, 0xe47d}, 0x1, 0x6e6bb2, 0x0, 0x0, 0x1}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x6}, @tfcpad={0x8, 0x16, 0x6f338094}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2d, 0x7}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x20040005}, 0x60) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x140, 0x0, &(0x7f0000000640)=[@enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:20 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0, 0xe}}, 0x8005) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_KEY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x20}, 0x8000) 00:50:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000000)={0x2}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000080)='syz0\x00') 00:50:20 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40402400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, r1, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x8}, 0x44080) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xc4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) socket(0x1a, 0x5, 0x0) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x140, 0x0, &(0x7f0000000640)=[@enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180)='nl802154\x00', r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r2, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_LEVEL={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r1, 0x420, 0x70bd2b, 0x10001, {}, [@NL802154_ATTR_SEC_LEVEL={0x2c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xb0}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x10000}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x4}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000005}, 0x40000) 00:50:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000840)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x4, 0x3, {}, {r1}, 0x0, 0x2}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x581300, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="06630437ccfd000299b2eac0a072a775fb844a582b805912d25be47785322efd01921cf34652d58d96ed73a2b545237caadefb2a95fd77439e2ad6be61882a916e9023b8faf6e7a299c6c181e920bfecf98ad0cf59bd9d34e95fd99d2b520d1904704d2b20dea006a60b2e81ca1cb216a532382c740bf1f98c0600000013d4dcb993de175053ee295f8e2c5f27b2e461fd33e6e525624c946198d74fb121b4eb29afaa29a3d904000000000000000d65f79d8e5fa617527f387327b75a72b83d8c2563b0dbecf3eb2597afd6132a1ab472d08fca31e4d2b869f53f4cf83ef8cb76fc135083b78ab7c42fe3711c0dd259"], 0xd4, 0x0, &(0x7f0000000080)="e385e2a0c9fc092816848fcfc99ca72422abbf4524e430e270b8f5ccdf7f48b9215acb962378943505133657d40697feb7bf3fd8c5e1851a36cf645e4a738e6b20fbddade4898323dd5b0685571e0ebf3195aa799a7f0be58c9985eb3ed924997aea12f6531ac2e8379c8cd41912cac760e183f9f6e263065ebf15b6015c6ddf7a4ea39aab1616f34ef66ce98404952392a3f741c14db0e04515b13a56457d754411a08cacd6f2f8c54a047d741ae560e059dfc795c78b68a7fe6dc1d7cf92035b4a62526308f070ffc6c805d7d3082440f9fe04"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="e1620871", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:20 executing program 1: getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x4) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) getresuid(&(0x7f0000000140), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000200)=@migrate={0x224, 0x21, 0x401, 0x70bd2b, 0x25dfdbff, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in6=@empty, 0x4e21, 0x6, 0x4e24, 0xff00, 0x2, 0xa0, 0xa0, 0x6, r0, 0xee00}, 0x6e6bb5, 0x2}, [@offload={0xc, 0x1c, {0x0, 0x1}}, @policy={0xac, 0x7, {{@in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x1a}, 0x4e23, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0x80, 0x3a, r1, r2}, {0x6, 0xffffffff, 0x109, 0x1f, 0xffff, 0x7f, 0xc5e}, {0x80000000, 0x0, 0x800, 0x1f}, 0x40, 0x6e6bb7, 0x1, 0x0, 0x3, 0x2}}, @algo_auth={0x119, 0x1, {{'ghash-ce-sync\x00'}, 0x688, "b7cbaacf381dffe8bb67c21d3ff91a4bf0849fd4e986ae1bca043ae407c2f016ab75fa4aaf4a6e7dac40dc5f65ad2e1156f78e8d7c467e671fe3eaa30a3fe9701f159d5793242fb80cfc15c309760dd02c954609a2d22863d0b8b7e09e71095ca924f77b94599d9bf1ae9fb0b784575afcf481628fbd1343664022aaa32ccee0dc0d919f709cac953b62855fd8f965e979c3c9238a83e6af2b852b2bd3f666d2e35a906cf33610f3190a98db743a113c7cc56c3b5e69a9f784219f5adf28a5f2dce8f905ac2c5f8cb0c5064e40b57a0c31"}}]}, 0x224}, 0x1, 0x0, 0x0, 0x80c0}, 0x4000000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000000) 00:50:20 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x140, 0x0, &(0x7f0000000640)=[@enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:20 executing program 5: r0 = socket(0x3, 0x2, 0x0) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0xa, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_DATA={0x4c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR2={0x5, 0x15, 0x7b}, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @ipv4={[], [], @local}}}, @IPSET_ATTR_COMMENT={0x7, 0x1a, '}[\x00'}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x35}}}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x9}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz2\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004050}, 0x0) 00:50:21 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f00000000c0)={0x274, 0x3, 0x1, 0x401, 0x0, 0x0, {0x0, 0x0, 0xa}, [@CTA_PROTOINFO={0x10, 0x4, 0x0, 0x1, @CTA_PROTOINFO_SCTP={0xc, 0x3, 0x0, 0x1, [@CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x80}]}}, @CTA_NAT_SRC={0x6c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @local}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast2}, @CTA_NAT_V4_MINIP={0x8, 0x1, @remote}, @CTA_NAT_V6_MINIP={0x14, 0x4, @mcast2}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}]}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x400}, @CTA_SEQ_ADJ_ORIG={0x34, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xfffffffc}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x47}, @CTA_SEQADJ_OFFSET_AFTER={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x819e}]}, @CTA_PROTOINFO={0x24, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x20, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x80}, @CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x6}, @CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ={0xc, 0x3, 0x1, 0x0, 0x9}]}}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x10000}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7ff}]}, @CTA_NAT_DST={0x124, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @local}, @CTA_NAT_V4_MINIP={0x8, 0x1, @private=0xa010100}, @CTA_NAT_V4_MINIP={0x8, 0x1, @private=0xa010100}, @CTA_NAT_PROTO={0x34, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @loopback}, @CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}, @CTA_NAT_PROTO={0x4c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}]}, @CTA_NAT_V4_MINIP={0x8, 0x1, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_PROTO={0x44, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}]}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1400}, @CTA_LABELS_MASK={0x24, 0x17, [0x2, 0xb807, 0x8, 0xfffffffd, 0x9, 0x1, 0x9, 0xd49]}, @CTA_TUPLE_MASTER={0x18, 0xe, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}]}, 0x274}}, 0x8000) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x3, 0xff, 0x3, 0x0, 0x0, 0xe004f3e, 0x2010, 0x4, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0x9, 0xf37}, 0x200, 0x0, 0x7fff, 0x1, 0x10000, 0x7, 0x6cbc}, 0x0, 0x3, r0, 0xf) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 510.500640] binder: 3442:3446 unknown command 1896375009 [ 510.528639] binder: 3442:3446 ioctl c0306201 20000800 returned -22 00:50:21 executing program 5: ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(0xffffffffffffffff, 0x7a5, &(0x7f0000000080)={{@host, 0x2}, 0x1, 0x0, 0x2}) getpeername$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x20) socket(0x1d, 0xa, 0x3) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xc4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) socket(0x1a, 0x5, 0x0) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03632040e79b297e33077e1cd35f4b2d38f78879d803fb81365ee2545a0cdf6f6c05bbc9ca0a5eb99752a897efac5548206baa68876f0a29f4febbd8c6109211282e61d54b72e92af971902076ac9055457c181c31d80b30483d7471df2afebb4850fe3d11078d937702cd70a6d17bc006add9c2f2c2585f1aae43cd40", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:21 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:21 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) socketpair(0x15, 0x2, 0x9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x20, 0x0, 0x203, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x4801}, 0x40000c0) [ 510.655326] can: request_module (can-proto-3) failed. [ 510.666767] binder: 3465:3474 unknown command 1075864323 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xc4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) socket(0x1a, 0x5, 0x0) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4000000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x90, r2, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVKEY={0x7c, 0x24, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_ID={0x64, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x44, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x2}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x44011}, 0x24000052) 00:50:21 executing program 5: socket(0x26, 0x3, 0x2) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, ["", "", "", "", "", "", "", ""]}, 0x14}}, 0x8000) [ 510.705706] binder: 3465:3474 ioctl c0306201 20000800 returned -22 [ 510.713311] can: request_module (can-proto-3) failed. 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000004c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1b, 0x9, 0x1, 0xcfd, 0x110, 0x1, 0x8, [], 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x40) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000200)="4aba13bf91e94b5044f90a3d65d2fdfcb846", 0x12, 0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x74, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@flat=@weak_handle={0x77682a85, 0x1, 0x1}, @fda={0x66646185, 0x1, 0x0, 0xc}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}, 0x40}, @clear_death={0x400c630f, 0x2}, @acquire_done={0x40106309, 0x1}, @exit_looper], 0x86, 0x0, &(0x7f0000000100)="7526cffbc06532fe0ff633822cf95aa7cba1d106dde31c4684e5223669d927d99aa5bf58f22fab2f5c83eb959b204b8d1609ecc2752f02df2517bc7db407a13124a9490c52c0c66fe76735930870a8d90b5a1da8cf5fdf576a5346ec7e8399246882c83790a272bc5aa9b805706df65507c3893aa2a63fc4da8b3119d5196fb8a616dfbedef2"}) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xc4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) socket(0x1a, 0x5, 0x0) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r1, 0x80000000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) 00:50:21 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r2, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040814}, 0x11) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r2, 0x10, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4041000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r8, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x2ce5a3be6d484355}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r9, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r7, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r9, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_OUT_LEVEL={0x8, 0x1f, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048000}, 0x20004004) 00:50:21 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@getae={0xc0, 0x1f, 0x2, 0x70bd29, 0x25dfdbfd, {{@in=@multicast2, 0x4d2, 0xa, 0x2b}, @in6=@empty, 0x1, 0x3503}, [@algo_comp={0x75, 0x3, {{'deflate\x00'}, 0x168, "69f342efe78f2e590c104a4f1b40d5b5bc94a5f62f7731e340d781fc1cc62bb1babc3d94db22ccde324b023bd3"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x7608}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000020}, 0x4800) 00:50:21 executing program 5: socket(0x23, 0x4, 0xffffffff) socket(0x2a, 0x81546053126d0c96, 0x9) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xc4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840d39d5d63b4708aa5a8ae7931519a56da62973cde8b194040c451ad1c4bea841c6318b08567950f5444f8974f4b7f4d6b10658b1c3923487cabd7892ec821b16aa685ee4dc58f6be45503dc22849b8cb0032da7db9ddce85abfa854795c0738a98734428b946c2a4a2efcea543ede024f355b985c345dfe941c4d082c272a932ef7d4cec108f9355f40f297d036e48e6704942fecbd43d26a286d655f76e810014e002b9b0f4eb423f12f938117e40663405b8115a4", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x148, 0x0, &(0x7f0000000640)=[@free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CCA_MODE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000228bd7000ffdbdf250d00000008000d00020000000c00060002000000020000000c00060008000000020000000c000600020000000200000008000d000000000008000c000100000008000c000400000008000c0003000000bf6b9a7ab346e1fcd94934d0978030f1dbb838f556a54a80bc8b0c674d6cf628ea17cb5f97e99332b7a477163d12c0a4a8a28ad9d65ff5d15afedd1cb6fde99c95a02ff29ede82fedc7005b65acdb88f692dbf43ec4cb349274223e6ec0c9bb11c3e433099139ed3d05a2638273b8cdd59"], 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x80) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) 00:50:21 executing program 5: socket(0x11, 0x6, 0x4d1c) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x148, 0x0, &(0x7f0000000640)=[@free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x8800) 00:50:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) openat$cgroup_freezer_state(r1, &(0x7f0000000000)='freezer.state\x00', 0x2, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00'}) 00:50:21 executing program 5: socket(0x26, 0x5, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x81, 0x4, 0x2], 0x3, 0x800, 0x0, 0xffffffffffffffff}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) bind$can_raw(r0, &(0x7f0000000100)={0x1d, r1}, 0x10) ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r0, 0x7aa, &(0x7f0000000140)={{@host, 0x2}, 0xbb, 0x842}) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x40, 0x0, &(0x7f0000000000)=[@dead_binder_done, @clear_death, @acquire_done, @decrefs={0x40046307, 0x3}, @acquire={0x40046305, 0x3}], 0x64, 0x0, &(0x7f0000000040)="7303d75abe0897ea475ebbef90b14416fa6bbefeb630087fcc34ee572196163f94964bd5be9c6c3a1ef878bd1df161ff805e34c2b7b2c3aea7cf1f0c55674774a3c7abcf6ae30731b11832420f0af2dad96853e0dd2e1fad271f716fd8783715c94b0aec"}) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x148, 0x0, &(0x7f0000000640)=[@free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x4, 0x0, &(0x7f00000007c0)="91754adb"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:21 executing program 0: pselect6(0x40, &(0x7f0000000000)={0x7, 0xbc, 0x7, 0x100000001, 0x6, 0x5, 0x3, 0x9df8}, &(0x7f0000000040)={0x3, 0xff, 0x20000000000, 0x9, 0x2, 0x7, 0x0, 0xfffffffffffffffa}, &(0x7f0000000080)={0x8, 0x0, 0xff, 0x1, 0x8000, 0xfffffffffffffff8, 0x81, 0x9}, &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000140)={&(0x7f0000000100), 0x8}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x3e) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x49865) pipe2(&(0x7f0000000240), 0x84000) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0xd) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='rdma.current\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x50, 0x0, &(0x7f00000001c0)=[@dead_binder_done, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, &(0x7f0000001240)=""/4096, 0x1000, 0x1, 0x6}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_binder={0x77622a85, 0x101}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}}], 0x6c, 0x0, &(0x7f00000003c0)="c302002a45cd832d45a6e39cdeab9af5f99152a8b73dc84c0ebb8157ba9c25aa5f778691329ae53f36e18f6cde78a567afcbc52212c2160a24286b81f9cb3271ece042f9701dc5a54f9c1d4cc91b4ef75490ac66af3f8fa18c00a16ffe623d9acbd1481b726ae364e9b02c55"}) sendmsg$NFT_MSG_GETRULE(r2, 0x0, 0x0) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r4, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000340)={&(0x7f0000000300)=[0x0, 0x7c], 0x2, 0x80000}) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYRES16], 0x1c}, 0x1, 0x0, 0x0, 0x4004045}, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEV(r5, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x28, r6, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000005c0)={&(0x7f0000000680)={0x50, 0x0, 0x100, 0x70bd29, 0x2, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x8}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc004}, 0x44) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00'}) [ 511.239203] binder: 3570:3574 unknown command 0 [ 511.243892] binder: 3570:3574 ioctl c0306201 20000000 returned -22 00:50:21 executing program 5: socket(0x18, 0x5, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) bind$l2tp(r0, &(0x7f0000000040)={0x2, 0x0, @rand_addr=0x64010102, 0x3}, 0x10) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={&(0x7f0000000080), 0xc, &(0x7f0000000440)={&(0x7f0000000140)=@delsa={0x300, 0x11, 0x2, 0x70bd2c, 0x25dfdbfb, {@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4d5, 0xa, 0x6c}, [@migrate={0x180, 0x11, [{@in=@remote, @in6=@ipv4={[], [], @loopback}, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in6=@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6c, 0x2, 0x0, 0x3505, 0xa, 0x2}, {@in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x3d}, @in=@loopback, @in6=@private0, 0x2b, 0x4, 0x0, 0x3507, 0x0, 0xa}, {@in6=@mcast1, @in=@loopback, @in6=@loopback, @in=@empty, 0x3c, 0x3, 0x0, 0x34ff, 0x2, 0x2}, {@in=@local, @in=@loopback, @in6=@dev={0xfe, 0x80, [], 0x19}, @in6=@local, 0x32, 0x4, 0x0, 0x34ff, 0xa, 0x2}, {@in=@rand_addr=0x64010102, @in=@multicast2, @in6=@loopback, @in6=@mcast2, 0x33, 0x4, 0x0, 0x3504, 0xa, 0xa}]}, @XFRMA_IF_ID={0x8, 0x1f, r2}, @replay_thresh={0x8, 0xb, 0x2}, @policy_type={0xa}, @algo_comp={0x13b, 0x3, {{'deflate\x00'}, 0x798, "9e8c161204231629362416b52859375f8eb99ea5e47f10e4dab29503dfb69cd578b754ecd32f9b6885ea97bf0e353709b2b5d0a7b670de5494055874ba4fddd0e448f5b7e78f05d02cfdc0bd1c114dbc35a8edb69a1707249ec37a3a4abd7e53272e325d7bdf45fc486e78d874fe505ba535e0f3ad2609b4622048e96c33f6e3267b42bfc4f41f9325ba637e96a496a10157ccc6ed0f4660f32f00509c3e88a16d009b085bbc3bf75deb65bb6a8049974c69fd482a924ffc6ee735db7622013846919f7cad7ba1528369f06a5994fe0bb8e90b5338976ddab4daea1ffda683dc06961681939a9a4b5dce3a1676ba040ab9912c"}}]}, 0x300}, 0x1, 0x0, 0x0, 0x4040040}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x20000) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 511.291043] binder: 3570:3574 unknown command 0 [ 511.296094] binder: 3570:3574 ioctl c0306201 20000000 returned -22 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000000)={{@my=0x1, 0x7fffffff}, 0x0, 0x1, 0xffff}) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:21 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff39}, 0x1, 0x0, 0x0, 0x24002055}, 0x24004080) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00'}) 00:50:21 executing program 5: socket(0x26, 0x5, 0x0) r0 = socket(0x7, 0xa, 0x5) socket(0x1e, 0x1, 0x4d) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x2, 0x1, 0x1, 0x1, {0xa, 0x4e23, 0xffffffff, @mcast1, 0x7}}}, 0x3a) 00:50:21 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_KEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x10c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_KEY={0x30, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x2c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7f}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_KEY={0xb0, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b5b94cf2c841c6995e2c68a5cad221ec"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x81}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "c7a27cc127ba7fc453f8d5fbf77c95fa"}, @NL802154_KEY_ATTR_ID={0x70, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x3778}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x5f5}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xfffe}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x10c}, 0x1, 0x0, 0x0, 0x8040}, 0x8001) 00:50:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) 00:50:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x4) read$FUSE(0xffffffffffffffff, &(0x7f0000000840)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=@newpolicy={0x280, 0x13, 0x10, 0x70bd29, 0x25dfdbfc, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x4e20, 0x0, 0x4e21, 0x24, 0x0, 0x0, 0xa0, 0x8e, r1, r2}, {0xb5, 0x8, 0x51cb30e4, 0x7fffffff, 0x0, 0xffff, 0x2, 0x3}, {0x0, 0x1, 0x1, 0xe1}, 0x20, 0x6e6bb4, 0x1, 0x1}, [@algo_auth={0x89, 0x1, {{'sha256-ni\x00'}, 0x208, "86699f4dec194b789dc9b5edfc493a6048bea5276c3743d62c4459b0a2d50086cb77cd0b88a387db9d0f9e00e727e8cab735661ebb3368cdab45b69c92c15a20a2"}}, @sec_ctx={0xd9, 0x8, {0xd5, 0x8, 0x1, 0x9b, 0xcd, "9b29a0ef301dfba196929a0adc34a955c3c3e4441152809e4782c5789a3e9bcc6d1285b9cfc4ac8eed924aa4ec6804a96b366a775e26c547a10751ce2901f383e16de6511c0df1786a32c167a46cf467f052163649e16df9d34895a50f7635eefbf2aa90349be61aeaca75f9fcb38de5ef1826479da66607a195c92fecd14a39addc7b827037bae1baef364cdc7378d14971e90883b9704d4f63a5ad36b1a84d35f9361d3eccb80d915487f45a80359266807bb629b2e652bf44a25923b9702b973902b6a951292004864f4100"}}, @srcaddr={0x14, 0xd, @in6=@local}, @address_filter={0x28, 0x1a, {@in6=@loopback, @in6=@private1, 0xa, 0x1f, 0x9c}}, @lifetime_val={0x24, 0x9, {0x7fff, 0x3, 0x3, 0x200}}]}, 0x280}, 0x1, 0x0, 0x0, 0x801}, 0x0) 00:50:21 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:21 executing program 0: sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x7, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION_ID={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004040}, 0xc080) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 00:50:22 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, &(0x7f00000007c0)}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x4000) 00:50:22 executing program 5: socket(0xa, 0x5, 0x7) 00:50:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) 00:50:22 executing program 2: syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0xa0800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) 00:50:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) 00:50:22 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00012cbd7000ffdbdf250c00000008000100010000000a000300", @ANYRES32=0x0, @ANYBLOB="0800010003000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40011}, 0xc881) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x68, r2, 0x96fc2aeffa210bd3, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_LEVEL={0x34, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x4}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 00:50:22 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000c00)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_PAN_ID={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x48081) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(0xffffffffffffffff, 0x111, 0x5, 0x10000, 0x4) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x24044044}, 0x0) 00:50:22 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, &(0x7f00000007c0)}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:22 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000800)={0xc, 0x0, &(0x7f0000000640)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000000)=[@clear_death, @exit_looper, @release={0x40046306, 0x3}, @clear_death={0x400c630f, 0x2}], 0x1a, 0x0, &(0x7f0000000040)="141b964bb12061c7d846a03b23740bfefd7a4c6a558a9f1a0061"}) 00:50:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) 00:50:22 executing program 5: r0 = socket(0x26, 0x5, 0x0) sendmsg$can_raw(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={&(0x7f0000000040)=@can={{0x2, 0x0, 0x1}, 0x2, 0x2, 0x0, 0x0, "2de797af20631242"}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x4040004) 00:50:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) 00:50:22 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x0, 0x0, &(0x7f00000007c0)}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) 00:50:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)={0xc8, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_KEY={0x20, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xfd}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "fb39dd0cac9c4f36792c8ab5c3501de3"}]}, @NL802154_ATTR_SEC_KEY={0x54, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x20}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xfe}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x1c}, @NL802154_KEY_ATTR_ID={0x30, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2f1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7f}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4005}, 0x1) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00', 0xffffffffffffffff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xc, 0x25, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}]}]}, 0x34}}, 0x0) sendmsg$NL802154_CMD_SET_CCA_MODE(r4, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, r6, 0x400, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x20}, 0x1, 0x0, 0x0, 0xc0}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000540)={'wpan4\x00'}) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="00000000347433cf528e00b49bd50fb2103748adae36e5791ced41ae2b4cf19bd5a32b2823ed083e692b75d1ffffffffed9d87000000000000c01e5f7bc22fb2cbc5fb1b0b2c", @ANYRES16=r3, @ANYBLOB="010025bd700013dcdf250400000008000c00030000000600290002000000050006000000000006001b004e24000006001a004e230000d4a78e916c35c4ab9cf87e3dac6f29db169560a5f0c7a7b9dbc0735e3aa60da0195eafc4e15fea0777d77df2b6130626723e38fbf0ab2a8a216c92efa216b67509e719b6e827de67914f97c78ae7a9fd0bc0ecf68a8d52db592dddccec1c2b02f54bb98587044812c3864d84b0d6bb45faae24313e0112cf8f80cb7021c6204b330b5c7d39d7d48a8240974e99bf03e6fb49a23547"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4040) r7 = socket(0x26, 0x1, 0x3f) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r7, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x0, 0x0, 0x0, {0x3}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40c0}, 0x20000010) 00:50:22 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000180)={0x0, 0xf52, 0x7a16}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000cc0)='nl802154\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x414, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x43}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000e40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000e00)={&(0x7f00000002c0)={0x34, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x34}}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f00000001c0)={{@hyper}, @my=0x0, 0x0, 0x6, 0x5, 0x510d, 0x7fff, 0xff, 0xb3}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x3c}, 0x1, 0x0, 0x0, 0xa089}, 0x4000) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:22 executing program 3: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) 00:50:22 executing program 1: sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="10012bbd7000fea5b0ea240000000800090003000000c9ff1451e75849f915e9f3b8c303d42646b930b76db6ae7cac6120b5b2f000a9c1186a790cbb25ca3142306b7fdd1f78aad4300a8d4b64105fd6b80958bf67bf143534ae95f6c992e6f22ec9c6ef05d010a1ae676cee4d3f6d95bb5b33f0889f1f85108c8a23618e11f131bdd9019542125a98ea196603d1be752c5bd909"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x41) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="2400db00", @ANYRES16=0x0, @ANYBLOB="000127bd7000fddbdf2501000000060002000000000006000e0090640000"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x24044004) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) 00:50:22 executing program 3: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040)='nl802154\x00', 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x40) [ 511.867779] kasan: CONFIG_KASAN_INLINE enabled 00:50:22 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001500), 0x0, 0x0, 0x0}) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) r1 = mmap$binder(&(0x7f00008a7000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000800)={0x14c, 0x0, &(0x7f0000000640)=[@enter_looper, @free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000380)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/83, 0x53, 0x0, 0x20}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, 0x0}, 0x40}, @increfs_done={0x40106308, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000400)={@fda={0x66646185, 0x6, 0x0, 0x4}, @fda={0x66646185, 0x8, 0x1, 0x3d}, @flat=@binder={0x73622a85, 0x100, 0x1}}, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/16, 0x10, 0x0, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/117, 0x75, 0x0, 0x16}, @fda={0x66646185, 0x9, 0x1, 0x23}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}}], 0x2, 0x0, &(0x7f00000007c0)="9175"}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) mmap$binder(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x11, r2, 0x80000000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r3, 0x0, 0x0) [ 511.904833] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 511.933877] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 511.940136] Modules linked in: [ 511.943343] CPU: 0 PID: 3683 Comm: syz-executor.0 Not tainted 4.14.230-syzkaller #0 [ 511.951641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 511.961000] task: ffff8880a8f4e480 task.stack: ffff88822d108000 [ 511.967071] RIP: 0010:nl802154_del_llsec_key+0x15a/0x2f0 [ 511.972522] RSP: 0018:ffff88822d10f698 EFLAGS: 00010246 [ 511.977890] RAX: dffffc0000000000 RBX: ffff88823a080300 RCX: 0000000000000000 [ 511.985163] RDX: 0000000000000000 RSI: ffffffff86dade84 RDI: ffff88823a080428 [ 511.993155] RBP: 1ffff11045a21ed5 R08: 0000000000000001 R09: ffff88822d10f990 00:50:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) connect$l2tp(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @remote, 0x1}, 0x10) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001200)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)=@delsa={0x104, 0x11, 0x200, 0x70bd2b, 0x25dfdbfb, {@in=@loopback, 0x4d2, 0x2, 0x6c}, [@algo_crypt={0x79, 0x2, {{'xchacha20-generic\x00'}, 0x188, "edf0dca44dd7c4e5925e274a0655b14c17d2997496609f363fc56e7824cdaef4b781379bc692d8e96848185b245df2c966"}}, @lifetime_val={0x24, 0x9, {0x615, 0x1f, 0x3, 0xff}}, @mark={0xc, 0x15, {0x35075b, 0x9}}, @replay_thresh={0x8, 0xb, 0xfffffff7}, @mark={0xc, 0x15, {0x35075d, 0x10000}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x8}, @policy_type={0xa}]}, 0x104}, 0x1, 0x0, 0x0, 0x20000010}, 0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) [ 512.000433] R10: ffff88822d10f6af R11: ffff8880a8f4e480 R12: ffff8880ab97ac40 [ 512.007741] R13: ffff8880abafd050 R14: ffffffff886f3810 R15: ffff8880a7271a80 [ 512.015235] FS: 00007f443b4c2700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 [ 512.023866] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 512.029781] CR2: 0000000000970004 CR3: 0000000230a3c000 CR4: 00000000001406f0 [ 512.037070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 512.044365] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 512.051656] Call Trace: [ 512.054249] ? nl802154_post_doit+0x150/0x150 [ 512.058875] ? lock_acquire+0x170/0x3f0 [ 512.062859] ? nl802154_set_llsec_params+0x420/0x420 [ 512.067971] ? nl802154_pre_doit+0xb2/0xb20 [ 512.072385] ? validate_nla+0x192/0x5e0 [ 512.076357] ? nl802154_dump_wpan_phy_done+0x40/0x40 [ 512.081451] ? nla_parse+0x157/0x1f0 [ 512.085177] ? nl802154_dump_wpan_phy_done+0x40/0x40 [ 512.090288] genl_family_rcv_msg+0x572/0xb20 [ 512.094699] ? genl_rcv+0x40/0x40 [ 512.098156] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 512.104735] ? trace_hardirqs_on+0x10/0x10 [ 512.108981] ? sock_sendmsg+0xb5/0x100 [ 512.112890] genl_rcv_msg+0xaf/0x140 [ 512.116595] netlink_rcv_skb+0x125/0x390 [ 512.120645] ? genl_family_rcv_msg+0xb20/0xb20 [ 512.125412] ? netlink_ack+0x9a0/0x9a0 [ 512.129321] ? lock_acquire+0x170/0x3f0 [ 512.133371] genl_rcv+0x24/0x40 [ 512.136652] netlink_unicast+0x437/0x610 [ 512.140702] ? netlink_sendskb+0xd0/0xd0 [ 512.144749] ? __check_object_size+0x179/0x230 [ 512.149326] netlink_sendmsg+0x62e/0xb80 [ 512.153396] ? nlmsg_notify+0x170/0x170 [ 512.157349] ? kernel_recvmsg+0x210/0x210 [ 512.161508] ? security_socket_sendmsg+0x83/0xb0 [ 512.166275] ? nlmsg_notify+0x170/0x170 [ 512.170274] sock_sendmsg+0xb5/0x100 [ 512.174001] ___sys_sendmsg+0x6c8/0x800 [ 512.177963] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 512.182718] ? do_futex+0x12b/0x1570 [ 512.186416] ? __fget+0x1fe/0x360 [ 512.189866] ? lock_acquire+0x170/0x3f0 [ 512.193824] ? lock_downgrade+0x740/0x740 [ 512.197991] ? __fget+0x225/0x360 [ 512.201439] ? __fdget+0x196/0x1f0 [ 512.204979] ? sockfd_lookup_light+0xb2/0x160 [ 512.209457] __sys_sendmsg+0xa3/0x120 [ 512.213239] ? SyS_shutdown+0x160/0x160 [ 512.217203] ? __fdget+0x167/0x1f0 [ 512.220723] ? do_vfs_ioctl+0xff0/0xff0 [ 512.224682] SyS_sendmsg+0x27/0x40 [ 512.228218] ? __sys_sendmsg+0x120/0x120 [ 512.232270] do_syscall_64+0x1d5/0x640 [ 512.236168] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 512.241373] RIP: 0033:0x466459 [ 512.244545] RSP: 002b:00007f443b4c2188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 512.252235] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 [ 512.259508] RDX: 0000000000000800 RSI: 0000000020000e40 RDI: 0000000000000004 [ 512.266769] RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 [ 512.274038] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 [ 512.281304] R13: 00007ffeddbd361f R14: 00007f443b4c2300 R15: 0000000000022000 [ 512.288563] Code: 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 85 01 00 00 48 8b 93 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 d1 48 c1 e9 03 <0f> b6 0c 01 48 89 d0 83 e0 07 83 c0 01 38 c8 7c 08 84 c9 0f 85 [ 512.307675] RIP: nl802154_del_llsec_key+0x15a/0x2f0 RSP: ffff88822d10f698 [ 512.321225] ---[ end trace 29bf1d1c509914ca ]--- [ 512.326727] Kernel panic - not syncing: Fatal exception [ 512.332571] Kernel Offset: disabled [ 512.336200] Rebooting in 86400 seconds..