00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:58:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:58:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0xc5000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3432.394386] tc_dump_action: action bad kind 04:58:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}) 04:58:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000002a2e000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3432.457837] binder: undelivered TRANSACTION_ERROR: 29201 [ 3432.528863] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3432.546247] binder: 12277:12280 got transaction with invalid offsets ptr [ 3432.571634] binder: 12277:12280 transaction failed 29201/-14, size 0-9 line 2995 [ 3432.640806] binder: undelivered TRANSACTION_ERROR: 29201 04:58:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) 04:58:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3c00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:58:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:58:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0xc5}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:58:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000]}) 04:58:59 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:58:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000200f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:58:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000068b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3433.175423] nla_parse: 2 callbacks suppressed [ 3433.175432] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3433.188618] tc_dump_action: action bad kind [ 3433.194415] binder: 12293:12298 got transaction with invalid offsets ptr [ 3433.212197] binder: 12293:12298 transaction failed 29201/-14, size 0-9 line 2995 04:58:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000]}) 04:58:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000501000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:58:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:58:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1c00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:58:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000005f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:58:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x2954000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3433.256470] binder: undelivered TRANSACTION_ERROR: 29201 04:59:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 3433.343510] binder: 12319:12320 got transaction with invalid offsets ptr 04:59:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}) 04:59:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3433.414498] binder: 12319:12320 transaction failed 29201/-14, size 0-9 line 2995 [ 3433.422652] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3433.431339] tc_dump_action: action bad kind 04:59:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x18000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3433.538679] binder: undelivered TRANSACTION_ERROR: 29201 04:59:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000002b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a000000}, 0x0) 04:59:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) 04:59:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x9effffff00000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x21000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:00 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:00 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000007f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3434.047586] binder: 12362:12365 got transaction with invalid offsets ptr [ 3434.073295] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3434.078188] binder: 12362:12365 transaction failed 29201/-14, size 0-9 line 2995 [ 3434.081891] tc_dump_action: action bad kind 04:59:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800]}) 04:59:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3a00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3434.132521] xt_check_match: 3 callbacks suppressed [ 3434.132534] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3434.195229] binder: undelivered TRANSACTION_ERROR: 29201 04:59:01 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000002f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x9effffff}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000a000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:01 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x2}, 0x0) 04:59:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) 04:59:01 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3434.992248] binder: 12408:12409 got transaction with invalid offsets ptr [ 3434.998895] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3435.007978] tc_dump_action: action bad kind [ 3435.027905] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}) 04:59:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000007fffffe00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3435.043909] binder: 12408:12409 transaction failed 29201/-14, size 0-9 line 2995 04:59:01 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000004f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x29540000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000004800000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:01 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) [ 3435.167751] binder: undelivered TRANSACTION_ERROR: 29201 [ 3435.213660] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3435.240965] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3435.249682] tc_dump_action: action bad kind 04:59:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}) [ 3435.264521] binder: 12440:12444 got transaction with invalid offsets ptr 04:59:02 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000007f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc00e0000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3435.321934] binder: 12440:12444 transaction failed 29201/-14, size 0-9 line 2995 04:59:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x29}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 04:59:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}) [ 3435.474372] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3435.525931] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3435.534585] tc_dump_action: action bad kind [ 3435.541743] binder: undelivered TRANSACTION_ERROR: 29201 04:59:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000060b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00]}) 04:59:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x5429}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:02 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000003f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x28}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:02 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc00e000000000000}, 0x0) 04:59:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x28000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3435.891574] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3435.900227] tc_dump_action: action bad kind [ 3435.914525] binder: 12489:12493 got transaction with invalid offsets ptr [ 3435.922353] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) [ 3435.968134] binder: 12489:12493 transaction failed 29201/-14, size 0-9 line 2995 04:59:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000020c4900", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3436.057589] binder: undelivered TRANSACTION_ERROR: 29201 [ 3436.124996] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) 04:59:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000005f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000500000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc5}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}) 04:59:03 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x17000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3436.797820] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3436.806435] tc_dump_action: action bad kind [ 3436.811754] binder: 12527:12534 got transaction with invalid offsets ptr [ 3436.834780] binder: 12527:12534 transaction failed 29201/-14, size 0-9 line 2995 04:59:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2200}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400]}) [ 3436.851430] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000006f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c}, 0x0) 04:59:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000100000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3436.932296] binder: undelivered TRANSACTION_ERROR: 29201 04:59:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}) 04:59:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x40030000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2a}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3436.987884] binder: 12556:12558 got transaction with invalid offsets ptr [ 3437.000217] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3437.008638] binder: 12556:12558 transaction failed 29201/-14, size 0-9 line 2995 [ 3437.008791] tc_dump_action: action bad kind 04:59:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="0700000cf64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3437.072180] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3437.131604] binder: undelivered TRANSACTION_ERROR: 29201 04:59:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000700000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) 04:59:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3f00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf00000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x74000000}, 0x0) 04:59:04 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="070000000a000000f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3437.688202] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3437.696814] tc_dump_action: action bad kind [ 3437.709677] binder: 12602:12604 got transaction with invalid offsets ptr [ 3437.719282] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596256268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}) [ 3437.736146] binder: 12602:12604 transaction failed 29201/-14, size 0-9 line 2995 04:59:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf0ffff}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x34000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4800}, 0x0) 04:59:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000074000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000]}) [ 3437.862866] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3437.889334] binder: undelivered TRANSACTION_ERROR: 29201 [ 3437.939740] tc_dump_action: action bad kind 04:59:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2a000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3437.967090] binder: 12639:12641 got transaction with invalid offsets ptr [ 3437.984942] CUSE: DEVNAME unspecified [ 3438.000919] CUSE: DEVNAME unspecified [ 3438.018361] binder: 12639:12641 transaction failed 29201/-14, size 0-9 line 2995 [ 3438.074053] binder: undelivered TRANSACTION_ERROR: 29201 04:59:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000007fffffe00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x2954}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c000000}, 0x0) 04:59:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}) 04:59:05 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b574cfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3b000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:05 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000005b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3438.572849] nla_parse: 1 callbacks suppressed [ 3438.572858] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3438.586121] tc_dump_action: action bad kind [ 3438.591568] binder: 12662:12667 got transaction with invalid offsets ptr 04:59:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1c000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000]}) 04:59:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 04:59:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3438.621384] binder: 12662:12667 transaction failed 29201/-14, size 0-9 line 2995 [ 3438.654424] CUSE: DEVNAME unspecified 04:59:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000012b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3438.703372] CUSE: DEVNAME unspecified [ 3438.708788] binder: undelivered TRANSACTION_ERROR: 29201 04:59:05 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b538cfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3438.751934] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3438.760517] tc_dump_action: action bad kind 04:59:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}) [ 3438.804608] binder: 12698:12699 got transaction with invalid offsets ptr [ 3438.858133] binder: 12698:12699 transaction failed 29201/-14, size 0-9 line 2995 [ 3438.874445] CUSE: DEVNAME unspecified [ 3438.903623] CUSE: DEVNAME unspecified [ 3438.944693] binder: undelivered TRANSACTION_ERROR: 29201 04:59:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a00000000000000}, 0x0) 04:59:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}) 04:59:06 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000048b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf00}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:06 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce63cac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:06 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x38}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:06 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3439.477915] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3439.486548] tc_dump_action: action bad kind [ 3439.491880] binder: 12718:12722 got transaction with invalid offsets ptr [ 3439.506619] CUSE: DEVNAME unspecified 04:59:06 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1d}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) [ 3439.522306] binder: 12718:12722 transaction failed 29201/-14, size 0-9 line 2995 [ 3439.533278] xt_check_match: 2 callbacks suppressed [ 3439.533293] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3439.558149] CUSE: DEVNAME unspecified 04:59:06 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000080b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xec0}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3439.617912] binder: undelivered TRANSACTION_ERROR: 29201 [ 3439.688878] binder: 12750:12751 got transaction with invalid offsets ptr [ 3439.699366] binder: 12750:12751 transaction failed 29201/-14, size 0-9 line 2995 [ 3439.742540] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3439.773909] binder: undelivered TRANSACTION_ERROR: 29201 04:59:07 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3848ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) 04:59:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3900000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000002a5000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xfffffffffffff000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}) 04:59:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3440.386150] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3440.394890] tc_dump_action: action bad kind [ 3440.399413] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3440.417354] binder: 12773:12775 got transaction with invalid offsets ptr 04:59:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00000000000000]}) 04:59:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3b00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xfffffff0}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3440.443680] CUSE: DEVNAME unspecified [ 3440.449723] binder: 12773:12775 transaction failed 29201/-14, size 0-9 line 2995 [ 3440.494444] CUSE: DEVNAME unspecified 04:59:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 04:59:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000002000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x4000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3440.555779] binder: undelivered TRANSACTION_ERROR: 29201 04:59:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac7448ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3440.598868] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3440.607470] tc_dump_action: action bad kind [ 3440.636545] binder: 12806:12812 got transaction with invalid offsets ptr [ 3440.668487] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3440.671796] binder: 12806:12812 transaction failed 29201/-14, size 0-9 line 2995 [ 3440.710045] CUSE: DEVNAME unspecified [ 3440.729116] CUSE: DEVNAME unspecified [ 3440.733248] binder: undelivered TRANSACTION_ERROR: 29201 04:59:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xb00}, 0x0) 04:59:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e792589a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:07 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3300}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc5000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:07 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}) 04:59:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000006000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3441.290996] binder: 12834:12838 got transaction with invalid offsets ptr [ 3441.298760] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3441.308140] tc_dump_action: action bad kind [ 3441.310909] binder: 12834:12838 transaction failed 29201/-14, size 0-9 line 2995 [ 3441.325213] CUSE: DEVNAME unspecified 04:59:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x25}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000]}) 04:59:08 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xffffff7f}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3441.340161] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3441.348936] CUSE: DEVNAME unspecified 04:59:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000007400000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:08 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd74d0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:08 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:08 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c00000000000000}, 0x0) [ 3441.411171] binder: undelivered TRANSACTION_ERROR: 29201 04:59:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00]}) [ 3441.496382] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3441.505186] tc_dump_action: action bad kind [ 3441.516264] binder: 12866:12867 got transaction with invalid offsets ptr 04:59:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2c00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3441.548183] binder: 12866:12867 transaction failed 29201/-14, size 0-9 line 2995 [ 3441.562783] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000fdfdffff00000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3441.609342] binder: undelivered TRANSACTION_ERROR: 29201 [ 3441.644321] binder: 12887:12888 got transaction with invalid offsets ptr [ 3441.683314] binder: 12887:12888 transaction failed 29201/-14, size 0-9 line 2995 [ 3441.707485] CUSE: DEVNAME unspecified [ 3441.743441] binder: undelivered TRANSACTION_ERROR: 29201 04:59:08 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd38d0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:08 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xb00000000000000}, 0x0) 04:59:08 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x4000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:08 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}) 04:59:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000fffffdfdb41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:08 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) [ 3442.184082] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3442.192728] tc_dump_action: action bad kind [ 3442.198770] binder: 12903:12913 got transaction with invalid offsets ptr [ 3442.216867] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:08 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000]}) 04:59:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3800}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:08 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc500}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3442.234091] binder: 12903:12913 transaction failed 29201/-14, size 0-9 line 2995 [ 3442.244495] CUSE: DEVNAME unspecified [ 3442.269813] CUSE: DEVNAME unspecified 04:59:08 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) 04:59:09 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b257c35b482b6ed2c0f74"}, 0x58) 04:59:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000]}) 04:59:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2800}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000004b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3442.406176] binder: undelivered TRANSACTION_ERROR: 29201 [ 3442.428938] CUSE: DEVNAME unspecified [ 3442.434868] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3442.443549] tc_dump_action: action bad kind 04:59:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3e}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) [ 3442.488337] CUSE: DEVNAME unspecified [ 3442.490070] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3442.504742] binder: 12949:12950 got transaction with invalid offsets ptr 04:59:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 04:59:09 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f3c"}, 0x58) [ 3442.546555] binder: 12949:12950 transaction failed 29201/-14, size 0-9 line 2995 [ 3442.613207] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3442.621880] tc_dump_action: action bad kind [ 3442.652622] binder: undelivered TRANSACTION_ERROR: 29201 [ 3442.668652] CUSE: DEVNAME unspecified [ 3442.690100] CUSE: DEVNAME unspecified 04:59:09 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xffffff9e}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000007fffffff00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x4000000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000020b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:09 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0xf) 04:59:09 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}) 04:59:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7400000000000000}, 0x0) [ 3443.080102] tc_dump_action: action bad kind [ 3443.095340] binder: 12984:12985 got transaction with invalid offsets ptr [ 3443.123705] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3443.139562] binder: 12984:12985 transaction failed 29201/-14, size 0-9 line 2995 [ 3443.230399] binder: undelivered TRANSACTION_ERROR: 29201 04:59:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00]}) 04:59:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x22000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:10 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x1058) 04:59:10 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x500}, 0x0) 04:59:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000feffff0700", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:10 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000709000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3443.979436] nla_parse: 1 callbacks suppressed [ 3443.979446] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3443.992719] tc_dump_action: action bad kind [ 3444.008897] binder: 13012:13024 got transaction with invalid offsets ptr 04:59:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}) 04:59:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3200}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3444.027910] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3444.043901] binder: 13012:13024 transaction failed 29201/-14, size 0-9 line 2995 04:59:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000001000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x100000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:10 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x20001158) 04:59:10 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x900}, 0x0) [ 3444.118122] binder: undelivered TRANSACTION_ERROR: 29201 04:59:10 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}) 04:59:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x18}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3444.176536] binder: 13041:13042 got transaction with invalid offsets ptr [ 3444.238561] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3444.247208] tc_dump_action: action bad kind [ 3444.259094] binder: 13041:13042 transaction failed 29201/-14, size 0-9 line 2995 04:59:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x81000000}, 0x0) 04:59:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1e}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:11 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000a50200000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3444.369212] binder: undelivered TRANSACTION_ERROR: 29201 [ 3444.414918] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3444.423566] tc_dump_action: action bad kind [ 3444.442395] binder: 13076:13081 got transaction with invalid offsets ptr [ 3444.461271] binder: 13076:13081 transaction failed 29201/-14, size 0-9 line 2995 [ 3444.515375] binder: undelivered TRANSACTION_ERROR: 29201 04:59:11 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r2) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) 04:59:11 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000200000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1d000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:11 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}) 04:59:11 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf0ffffff00000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3444.861584] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3444.870433] tc_dump_action: action bad kind [ 3444.900891] binder: 13094:13098 got transaction with invalid offsets ptr 04:59:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x39000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 04:59:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6000000}, 0x0) [ 3444.939096] xt_check_match: 2 callbacks suppressed [ 3444.939110] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3444.969066] binder: 13094:13098 transaction failed 29201/-14, size 0-9 line 2995 [ 3444.981210] CUSE: DEVNAME unspecified 04:59:11 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x9effffff00000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3445.004316] CUSE: DEVNAME unspecified 04:59:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:11 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) [ 3445.050607] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3445.059232] tc_dump_action: action bad kind 04:59:11 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000ffffffffb41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:11 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x2) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x8, 0x3, 0x2}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bond_slave_0\x00', 0x0}) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000011c0)={@dev, @broadcast, 0x0}, &(0x7f0000001200)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001240)={'team0\x00', 0x0}) getsockname$packet(r1, &(0x7f0000001280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000012c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000013c0)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@remote}}, &(0x7f00000014c0)=0xe8) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000001500)={@rand_addr, @multicast1, 0x0}, &(0x7f0000001540)=0xc) accept4$packet(r1, &(0x7f0000002900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000002940)=0x14, 0x80800) getpeername$packet(r1, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000006a00)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000007f80)={{{@in6=@ipv4={[], [], @loopback}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@remote}}, &(0x7f0000008080)=0xe8) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000008100)={@dev, 0x0}, &(0x7f0000008140)=0x14) getsockname$packet(r1, &(0x7f0000008180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000081c0)=0x14) accept4$packet(r1, &(0x7f0000008200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000008240)=0x14, 0x80000) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000008280)={{{@in=@remote, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f0000008380)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000083c0)={{{@in6=@local, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f00000084c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000085c0)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@local}}, &(0x7f00000086c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000008700)={'veth1_to_team\x00', 0x0}) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000008740)={@local, 0x0}, &(0x7f0000008780)=0x14) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000089c0)={0x0, @broadcast, @multicast2}, &(0x7f0000008a00)=0xc) recvmsg(r0, &(0x7f00000090c0)={&(0x7f0000008f80)=@hci={0x0, 0x0}, 0x80, &(0x7f0000009080)=[{&(0x7f0000009000)=""/118, 0x76}], 0x1, 0x0, 0x0, 0x1}, 0x2) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f00000097c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1800000}, 0xc, &(0x7f0000009780)={&(0x7f0000009100)={0x644, r2, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x78, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xe}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r5}, {0xf0, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r9}, {0x80, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x45}}, {0x8, 0x6, r11}}}]}}, {{0x8, 0x1, r12}, {0x40, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'random\x00'}}}]}}, {{0x8, 0x1, r13}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r14}, {0x88, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x85e3}}}]}}, {{0x8, 0x1, r15}, {0x1d8, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x401}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x1f}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r19}, {0x12c, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x40de}}}]}}]}, 0x644}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3445.094209] binder: undelivered TRANSACTION_ERROR: 29201 [ 3445.174122] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3445.188804] binder: 13139:13141 got transaction with invalid offsets ptr [ 3445.202186] binder: 13139:13141 transaction failed 29201/-14, size 0-9 line 2995 [ 3445.246776] CUSE: DEVNAME unspecified [ 3445.258513] binder: undelivered TRANSACTION_ERROR: 29201 04:59:12 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x32000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000]}) 04:59:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xfffff000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:12 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000400000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x74}, 0x0) 04:59:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:12 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:12 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) accept$inet(r1, &(0x7f0000000000)={0x0, 0x0, @loopback}, &(0x7f0000000040)=0x10) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3445.796266] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3445.806373] tc_dump_action: action bad kind [ 3445.814621] binder: 13157:13158 got transaction with invalid offsets ptr [ 3445.835304] CUSE: DEVNAME unspecified 04:59:12 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3600000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x400300}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3445.845375] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3445.848380] binder: 13157:13158 transaction failed 29201/-14, size 0-9 line 2995 04:59:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 04:59:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 04:59:12 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000040)={0x100, 0x2, {0x0, 0x2, 0x7f, 0x0, 0x15c}}) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:12 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000007a00000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3445.990005] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3446.009892] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3446.018655] tc_dump_action: action bad kind [ 3446.026796] binder: undelivered TRANSACTION_ERROR: 29201 [ 3446.102414] binder: 13201:13205 got transaction with invalid offsets ptr [ 3446.126740] CUSE: DEVNAME unspecified [ 3446.139616] binder: 13201:13205 transaction failed 29201/-14, size 0-9 line 2995 [ 3446.173942] binder: undelivered TRANSACTION_ERROR: 29201 04:59:13 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3100000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 04:59:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:13 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) pread64(r0, &(0x7f0000000100)=""/4096, 0xfffffffffffffdf4, 0x101000) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6c000000}, 0x0) 04:59:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:13 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000006c000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3446.700868] binder: 13218:13222 got transaction with invalid offsets ptr [ 3446.701816] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3446.716580] tc_dump_action: action bad kind 04:59:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}) 04:59:13 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x37}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x200000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3446.741600] binder: 13218:13222 transaction failed 29201/-14, size 0-9 line 2995 [ 3446.750356] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:13 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000]}) 04:59:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xb}, 0x0) 04:59:13 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f00000011c0)={0x1000, "be0de651638ab6740c6c736d434d3653bc524323d53a44131e9f8448d5bcc9caa60e745b99cf81857c745249816eabd4b5b1da78758bd371c4d8299b83ea55ceb44303ed85a99fdc0d2a4497e3e1df16a0d939121405099a26eaf125e2d3fdffbc7cc0767018fbf91eb922f50beb5100f1eaf26ec181026037f0dc24ede0fd37fe8f555e0f68f31d84e59330f2a829f3fcdfa14d7d7eb6781ebc5d98a880cd31d074cf2e604b76074db3c4c0ff29b26cee71082e99bad4b1e1d23ef6a633c426efd605b37d948ed45b3d9ced28b354b6a6b01b3ff814b32ce2b1c25827770e33e20ad8af737482ce6fd35101c28490ac8038ead2abb408eaa52fe03014aa6e86ab82069de3128ca99cbee00dc96b1d52aac2766b10dcee0dd8795669737c7c1a43200d22d3e7ef697d4f4db9c8528a5531bed1c86a5f9db7f4f1374c46ff8e24323ae6c53e6b256957b03d5e884b5eaedab29824475623470cecb3cdec67f03284299032600c918a6549529d61db3174c004b3b84545ab3958deca5073a00ec1517bc2e813c2fe678dcaba89e5b6ae7e51a665af4ed7c37be3d11f2933973b4c3173ae8b69d05951ca1f3e480f0b78c6df7f85cc469cfd1c8c9fe803f5ec7bf7cd6eb685cc1710f048a07d5cb46f19dd0ea1d7186ec80b3ea26dbc4dce78fe064cd72425bfeceb9d8149297bffb9f9f54c5d141e1879dd550ca586f6c35a888840bf1cfeb3cf433123f9432586aeb1ae8dc624b6fdd9a54c36a71fba73dda5caa836c6419ddcdfe3e37385a68dd497306fc49926d626f233c286cca7c599933895af55b851ed64523efa135a5ead12e4e1e365425a8a9c887728737542beff1cbcc104fcaffdca2fb38059f61b23bbac84c84c666da41faf2ae99127592ba6d782345f4d88c6ca27aeaa284cbf1e74c3722bf33873e634c33fb7653e743a8563c15493ea58edb4d1a62769030a13addc266a85c390736a803cbb44201b0c0a3443a0f6f5e442951bd5ae95f3ee46ec6ce1bfdc7806cf7748e025c46a3db2a7176d64ffe68162e59023359daef5f76bfae5ed24a2a47665095adee1d1fccdeaca691c8b74698e812b09d165851f75c676f949edb5b98781250362f0e9594ad5a1859379a14b8bad018ad395476dc8944b7ac375be565008c194a5cbad1d9b087a3a47730c9a59f5610714878e2b564514718081016d5ad70a811f2b2805cd34be66e8804954e633384658353de15f10a9df322c15d89d0ba3a90ae9cc73973dfecc91eb204d5d0e9dff77a35a7ae381d79653fdcaac257dbf19e5f76e4b4d42a7fe59f131a398508b747c15ee89d2e95f165a78db417c34c1bd5af5556afa453205b79de5cf22fecfc98e59a6fc4c80ca38f7593b3a907ceefaa0ff0894fd073de7a4a8f03b053605129bafaa21ec30f8bdd2144dbe45dec861435ed14631449c6d94788e72fdc830299826f1dc7494ca4aefe8d21166ab0dcbf1d45a729b6c94e4b0cebacdca77c9c680bfa4597228e3425cabe86957ca4f6f462063bf6bcee0239fe935ab42ee8a0abe21cb67179054d84f658b8678af02068d0a4ae9b4de86d38d7f34d0b18bfb04c544b1d6b67cc1848b9f7d22fa336ae06612a91b8729b9dfa574caf1b780ef172eb076a10ac8adc266b8c2463f90d124cb1f69f30e1c1687eb0c4fb71177bcb92d40561c5e32248a639b4bbc3f21c7b3e8f257ad88eea5201a5727d90bace8411651107825a7cafb521d0a8aefd128b95bb6b3d1a22403ff9744e10205b82a9922ecbf2709c07a68dadc1bd76fc876bc77d923e4a74ff24d51bd6c3b721684f0cb4668e4f40d6b07f3570901dd7e04ec6db941fee7a8d76a40e4cc14a78280bc60e5c3a15e074e54c129d589451258ef8aebfc560089954842432d4a4fe7ee850cf4155b2b66b4ce48418dab104b4968ec901d9952e2fa7064c3cf1a08a3b8d36b132abfaf2bd8d0c14238bc51d68f5ef4ae9dfcab580154fe2cea09cffcbd3d75ad7f71afd3a37c5563cb1afa791494e3dcce11a98402f43573531b3ca097e5ab5a4bbf39228d9708ed7aa98f1bf9dbe4564523511c990d0bacf031f078671fe925d4b7bd32cdd84d2f2fc4e4af55f32be3c4a8b623735ce6726a67988dd1a05db53097537aba57fc61f10680c4d2109091380d6ab0bed3590c80b427fb3df3d26663f5ce06654dc52cfee97034d3dfe520b1632a261222a5d8272bffad47934513b68d7fb2e0cfc37c1f5d91957d21bb6979c0a99ceff2fcb265dbc04a24f39e340de887f847685c90017228184932e3dd3b479fc7d44846d6b48a734175e18ede6d912d1c2ce95836d536c5156eaaa7c685c52c440f899f7b1003331b9c101d990710248f9b5e00e79642d41f6b035ed96deb4090f742658a0e0d098484d3b6af43e6a2fe5d515ac1f9cbcb3ea724f0f643ff9ec0f61b163dbe2b358b20be20962cfca012a124ad89cfea645a59ce3293405ce07611724d1721e745d3c784a4a184cf7063e5da14a8b9aaf769b19cc0c6a93fb36a01a6644b19037e3c7eff50e6ae973f8f3a226fa5c9bfd5efaf25e52a13ebe4732780a4ed050a955976ea30f699d60af422653faf6216fd2867a34af8e559b182b17814a47e2515bb2e9f0e7b9082802305c9cf1889d5a336079cccc219b4387a459825c9cc7488ad0814794cc22f540acfc7a050d89108782de29bd0dd543905876cce254b7cb946d1ce8f6b67e4cd7a99d1b2740555168c0b27fc19f0079abad8dea12d31e629c3a478f874349951f45e3f84f2351f5952ed7163d34895c89c6fc1152adc016f841213371ab6f32a7690b85e4ff90f02c5e9146cbe92d855a167a05197939fe62298ce7bb104f02f84f366d618321c605a68aa6073b32e5373581b4d67c4f54b8f4f5cf70b86e26141010a93def5a81f77186255950affb3d89c46ce5fd7b9383d0f984abae1d01eb24c75b0d4b2eabaeb4ca1cdf59e50f97e5008d7aa17fba3cec9c4597a8f38d36cdaaeda05abfeeae7cbbf314788fb323ef75fd64fccb1d0e029da0230b8e7ba9dc80bc524b23ca85c8ced352ab0ec56672d74a0c77cd83e500b72f6525e5c071ad44ae9ee82dc1136688d37082b1080bc6d9583184fc5a03a80a95c09027700e122346ea29f5afe73f5885533bbd461263ca516387da960ce347c4fd06575b2f586c8f7ea60a117de2ebad9bde0e2383aff2f336e522d2b9fd506ad74ceb668f0006887e7d967be5125f6a7e99c448026c759f1e5253ba1e52d1f59a359552cb0c5b3dc47339034f2b33f533a0b24a2585c1747510a2a333f3539f88292aa1155fc49cf9e493c13910b412c8a16c2472f24998cd1bbf7be816ff04252c40fb4df5965b090540f64546b898b02ba43a3d5133efaf308293b68e71ca5dfdec78a6d6066049f0fa1a180050f04151b9c5be21e6cf9cb2f48951e46bde3cf01bae078cc6d2403de7901a6f3556bdcab0fdfb993e9ef6713989840d67608c88aab3485863dae0dedf3fca7d74d6c76bd3bf2467a47fd3a17280706886fd418620fdf30eeddf5efc986218eb1d04c2d259f7b396254ee436719e8e9acbe2541a1ad5dd10cb2a439c468ba36c7d1209d7c687040cea195b9ce032a63c91e6adc82ee38df664b4c26047e8d8e5690f2a23922f29b72dbddb949a3144605eb5a092e369a3310bb6641610df01c53a2f78b5be74c79f64de1623d305eab6087f3307a46473b96fbb2bfee1c52262bcf64f58018830cfaa6cd74869f9eb3b1629512e41b84a4dfa61def9b28a054cb3cb1b0de91a026b32fc5db5848dfb11950cae6e63a4ea857ce40abb5e933e2bf14b2821ffa393180a4173bfe8147ca6a4cd0fb157e7cb9676dee9b66fe7f63ff07bd91c3bdea2be45d8c7abfbed42582d97d245e78d9ba523f6cb076bf8493f4be998504b9770ca58ea471c808d72d00a722aa892cb94f844b427020784f5076e4c65051226acb6690caf4ff64a33ae024da23157d4a93753d443513cc7720ec1f5225b0e31475847d84cad0654dc20aa6615818eb17786369c53d5a60814300dea83aec66719a634429b96f8dadc5230016c642c4d74ce17d35bbcafb8284a108708f75fb6d0f9587e0d7fa8f017f458573bd4bacc948bfd7ee0004ba9251f3049da0368774e1bc27f8281ace67d68dc4bf445bf0e79c7083cd0f176cd9eaf345dbe0a92e697341e4a0fca3736aa3d302667692d3da929631346c4a63d6b254f64f8a3eb8538ff86160f7c4a266667fa5e79c584d2b4a92e9fc9c1c603eda3586ef99c0ba5bf7274b0a9bf80cdecb51d88d9a3fe5314379c99283ebc9aeca836c84cdba69e54c3973b35609b8b925c77fad51fb86a7f008159db8e8fb0c7a874c9b985e07c3c4da72775b5e1ad3ff8fc137b535901402527a6d4e50f1f3fe9256d386f7932579cc51ad2c5743492e01251f4ae84a377d4d077ded2229c47597439e932eb305a6ee773603bef45f4ca20ce4f37eaedad45be1aee456881e58103827ade03d483b239c9037a31900973d4d0ecbd7d1bb849c23695a350aebba78854f1a2ba76addea51e50a4076173a71e6755526f06aff6ff3a38e18f59a967337f8e78f15e0d53963a6ba0ce8178715e90834a6c35d33361551fc1f65f731a33155c62df874de7a58c455e4fc12572aff6dd6d30f62b2c567f7c0842cee9ee0035bad957816b2e891049004329419175468994b36234dba270f1a54891cb82d8510710fe6b18c4d95905d76bc218e540470f91137c215044722ee1be3aec7bd29463c6eac9cb991f7ec3557271ef4a5b4015db2b1e3a9c40fc2cda5a794c013c876716c53169e0d18fb7d52c664a4997266b31079467ae332ad49d035154b6cf43194d792245f51dfac7e4aa34a29fe71903f99f7b5aca5e9daeb97245d0176e588fa32486b1ec8c6dcd8e8e2d00ebb8f4b91df03f44c5b200daf06c2fab942e276eb519300ff874fcb9e1e1975df1be7f44393585d9fad2764ab759e3a0a8cb28a3fbb1aa4195b2f3d6bcb873b85f66275b0b71595e5624868dcc2bee6059c05df16053c83a39765649a33efcfc1a0477aed80700bade31cfe4ff4dbe5e81066dea7519fc61bae1b1fd3bdbbf09c5e142169bf3a3144754a32adbdb4965615449d31b36c2ee9610fe21bfaf9aeffa04bc485219ff01682237ad7ff06f2a1612981bbc698fe1c1d7866cc865fcd5c3fc01972f714431fb4abd0e4785f40ebf1350ac5bbd43d21ed5b8d0c64a335a50ca3aa6624eb9577dabf2dfc6f3da1dc7fd2f788d3be7182fd5216322fe1525f27963071456ac6b92546b3ff02ac5767525a237a45e4a9e2c39124cba4660f9dc526d6f4992b675be1353422263c7185184394d581dc93813c3d5e08c4753577579a7e6110779f413cc48a7376b742b40b457da15821f380374753a852d9f857ec125b06076f3cf2973af47c90cd8543f8982e09026045441189d70a370b63fbd2199a856aafd3fc31ff173f39b4ed93cdb3da4f623319ab9c3a9f16a9d00cc155821a7041151ef45158cf6647e9988f03fbf85afe3851d8a887b47f0a93200af5c9c3cdf1e9e5b8442c92bb55a218fae250312958a9a091b4440847a099ed95f0612e1bfd7dea41681049a8ef126bf3ce52e01813c1a5276ec6f585248e324791812faa39b6673692c020bcd9c3a165279e079cc45b09d3d121c306c56651f1d9b90e33f38b5f8d1571dbf401bab17b92f7bbad87be8bb93a8db37ec6716570f7a9832dcc3788386a1729f62c2277ac5de095b1aa7c956807"}) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000000000006cb41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3446.868609] binder: undelivered TRANSACTION_ERROR: 29201 [ 3446.918111] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3446.944812] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3446.953514] tc_dump_action: action bad kind [ 3446.970867] binder: 13255:13259 got transaction with invalid offsets ptr [ 3447.013260] binder: 13255:13259 transaction failed 29201/-14, size 0-9 line 2995 [ 3447.075861] binder: undelivered TRANSACTION_ERROR: 29201 04:59:14 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xffffff7f00000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:14 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:14 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") syncfs(r0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000000)={0x3ce, {{0xa, 0x4e20, 0x12cf, @mcast2={0xff, 0x2, [], 0x1}, 0xfff}}}, 0x88) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f00000011c0)) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914ae19f489ce638ac3c48ea5a790930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74000000000000000000000000000000"], 0x58) 04:59:14 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000400000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000]}) 04:59:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 04:59:14 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3e00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3447.576512] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3447.585150] tc_dump_action: action bad kind [ 3447.612412] binder: 13279:13283 got transaction with invalid offsets ptr 04:59:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}) 04:59:14 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1f00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3447.637973] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3447.644328] binder: 13279:13283 transaction failed 29201/-14, size 0-9 line 2995 04:59:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7000000}, 0x0) [ 3447.693321] CUSE: DEVNAME unspecified 04:59:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc00e000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:14 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:14 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000006800000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3447.720796] binder: undelivered TRANSACTION_ERROR: 29201 04:59:14 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) [ 3447.772761] tc_dump_action: action bad kind 04:59:14 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x100, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x101}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000000c0)={r2, 0xed02}, &(0x7f00000011c0)=0x8) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r3, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r3, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) socket$inet6_dccp(0xa, 0x6, 0x0) [ 3447.823138] binder: 13305:13309 got transaction with invalid offsets ptr [ 3447.864142] binder: 13305:13309 transaction failed 29201/-14, size 0-9 line 2995 [ 3447.872191] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3447.908648] CUSE: DEVNAME unspecified [ 3447.929755] binder: undelivered TRANSACTION_ERROR: 29201 04:59:15 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2800000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf0ffffffffffff}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:15 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000730000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800]}) 04:59:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:15 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:15 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x801, 0x0) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x1, 0x7) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000011c0)={r3, 0x93, "d801b704d8274ae99ef48b17309371123cf64237d284aef98ca61ba620e1264110ffb0077abd7fa2053c6506524226e47ec90831ad4de8a37d3f98375fbe1e3c5ee0991c356579688a23bc684de542ee3256eb3eb9868a814959d87f819f428d51db1b7035bbaebb189f1eaead185867d11d424e2f31e0c4109cbf7aea5961105797d8016250f97686ff4f088bc6e4bfc25d9e"}, &(0x7f0000001280)=0x9b) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:15 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x9000000}, 0x0) [ 3448.483955] tc_dump_action: action bad kind [ 3448.498580] binder: 13336:13337 got transaction with invalid offsets ptr 04:59:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 04:59:15 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x25000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:15 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 04:59:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3448.530517] CUSE: DEVNAME unspecified [ 3448.545552] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3448.546848] binder: 13336:13337 transaction failed 29201/-14, size 0-9 line 2995 [ 3448.576335] CUSE: DEVNAME unspecified 04:59:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x2954000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3448.636538] tc_dump_action: action bad kind 04:59:15 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) r2 = shmget(0x2, 0x1000, 0x10, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="580000000000000001000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638050000005a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74f9c2dfe96d8a2cbe69ce3f5105f2b5e3e19a0829452974e5bdb372774fc346ad693ccde7c2ba233ca08feab751f04e3284d0db5ba4d10487ebd9104ef7beccb10eb4beeb4e4a0b5adbc440b43694eba3390464d80c2ae9531b247c3541b5e24933a00231586a69a951982f0188e9a6d5539c42a455ff7b47f272155d314b6c52030000"], 0xb4) 04:59:15 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000007400000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:15 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}) [ 3448.701202] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3448.718187] binder: undelivered TRANSACTION_ERROR: 29201 [ 3448.813075] binder: 13378:13381 got transaction with invalid offsets ptr [ 3448.839252] binder: 13378:13381 transaction failed 29201/-14, size 0-9 line 2995 [ 3448.896243] binder: undelivered TRANSACTION_ERROR: 29201 04:59:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1f000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf000000}, 0x0) 04:59:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 04:59:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf0ffffff}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:16 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x8, 0x4000) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489c033d231d79e5a83d000000000000001930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000001100)={0x303, 0x33}, 0x4) 04:59:16 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000600000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3449.401200] nla_parse: 3 callbacks suppressed [ 3449.401208] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3449.414563] tc_dump_action: action bad kind [ 3449.420737] binder: 13392:13396 got transaction with invalid offsets ptr 04:59:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:16 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x1402000, 0x0) socketpair$inet6(0xa, 0x6, 0x80000001, &(0x7f00000012c0)) socket$inet6(0xa, 0x80001, 0x2d2) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f0000000080)={'broute\x00', 0x0, 0x4, 0xcf, [], 0x3, &(0x7f0000000000)=[{}, {}, {}], &(0x7f0000001180)=""/207}, &(0x7f0000001280)=0x78) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2300}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}) 04:59:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc500000000000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3449.450980] binder: 13392:13396 transaction failed 29201/-14, size 0-9 line 2995 04:59:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000006000000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6c00000000000000}, 0x0) [ 3449.577802] binder: undelivered TRANSACTION_ERROR: 29201 04:59:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3f00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}) [ 3449.652680] binder: 13435:13436 got transaction with invalid offsets ptr [ 3449.666278] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3449.675257] tc_dump_action: action bad kind [ 3449.698301] binder: 13435:13436 transaction failed 29201/-14, size 0-9 line 2995 [ 3449.794162] binder: undelivered TRANSACTION_ERROR: 29201 04:59:16 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}) 04:59:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000e0a20200000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:16 executing program 2: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x80, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = syz_open_dev$sndtimer(&(0x7f0000000180)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000001c0)={0x0, 0x84, 0x9, 0x0, 0xc}) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000001100)=@req3={0x5, 0x101, 0xffffffffffffffd5, 0x80000001, 0xa3, 0xffff, 0x6}, 0x1c) pread64(r3, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000001140)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}, &(0x7f00000011c0)=0x10) write$fuse(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689cf6aad3e48cf50a7c0dd3cd0194b0a7c353df8298f67ddd22a6cb0c17b1e14ac99b25c7b6d9823078ad9730392efafb8e1203ed12886a7c49903dc92fbce4a4de6e4bcc37bb1902c2788aaaf06ea49ce"], 0x58) 04:59:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1b}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000000400", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) [ 3450.279065] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3450.287667] tc_dump_action: action bad kind [ 3450.309222] binder: 13468:13470 got transaction with invalid offsets ptr 04:59:17 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0x34000}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x17}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 3450.330223] binder: 13468:13470 transaction failed 29201/-14, size 0-9 line 2995 [ 3450.347969] xt_check_match: 4 callbacks suppressed [ 3450.347982] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:17 executing program 2: r0 = socket$inet6(0xa, 0x4, 0xffff) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3450.433181] binder: undelivered TRANSACTION_ERROR: 29201 [ 3450.526527] CUSE: DEVNAME unspecified [ 3450.541386] CUSE: DEVNAME unspecified 04:59:17 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x500000000000000}, 0x0) 04:59:17 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000007fffffffefffb41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:17 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:17 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xc00e}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x33000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}) 04:59:17 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:17 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000040)) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000000)) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:17 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 04:59:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x26000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3451.206491] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3451.215142] tc_dump_action: action bad kind [ 3451.236015] binder: 13510:13521 got transaction with invalid offsets ptr [ 3451.244907] CUSE: DEVNAME unspecified 04:59:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503, 0x0, 0xf0}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:18 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 3451.279237] binder: 13510:13521 transaction failed 29201/-14, size 0-9 line 2995 [ 3451.279408] CUSE: DEVNAME unspecified [ 3451.309257] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000fffffdfd00000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000000020c4900", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}) 04:59:18 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3400}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0x15, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3451.369860] binder: undelivered TRANSACTION_ERROR: 29201 [ 3451.399951] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3451.408703] tc_dump_action: action bad kind 04:59:18 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0xa00, 0x0) getsockopt$packet_buf(r1, 0x107, 0xd, &(0x7f0000000040)=""/97, &(0x7f00000000c0)=0x61) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3451.458619] binder: 13543:13546 got transaction with invalid offsets ptr 04:59:18 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2a00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd000000]}) [ 3451.517875] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3451.529906] binder: 13543:13546 transaction failed 29201/-14, size 0-9 line 2995 [ 3451.539172] CUSE: DEVNAME unspecified 04:59:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xb, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3451.580714] CUSE: DEVNAME unspecified [ 3451.632894] binder: undelivered TRANSACTION_ERROR: 29201 04:59:18 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:18 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x60}, 0x0) 04:59:18 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3d}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000000100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:18 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}) 04:59:18 executing program 2: r0 = socket$inet6(0xa, 0x800, 0x2) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0x2000000c, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000001200000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3452.083832] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3452.092450] tc_dump_action: action bad kind [ 3452.111183] binder: 13588:13596 got transaction with invalid offsets ptr [ 3452.122868] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3452.151440] binder: 13588:13596 transaction failed 29201/-14, size 0-9 line 2995 [ 3452.200661] CUSE: DEVNAME unspecified [ 3452.227580] binder: undelivered TRANSACTION_ERROR: 29201 [ 3452.250519] CUSE: DEVNAME unspecified 04:59:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}) 04:59:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0x10, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:19 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x22}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:19 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48000000}, 0x0) 04:59:19 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000003b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:19 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:19 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x2000000003) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = syz_open_dev$usbmon(&(0x7f00000011c0)='/dev/usbmon#\x00', 0x100, 0x100) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000001200)=0x1b270bef) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000001240)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3cbeff5a791910b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) [ 3452.997830] binder: 13621:13629 got transaction with invalid offsets ptr [ 3452.999441] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3453.013583] tc_dump_action: action bad kind [ 3453.027339] binder: 13621:13629 transaction failed 29201/-14, size 0-9 line 2995 04:59:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xa, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) 04:59:19 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3d00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3453.046823] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3453.076414] CUSE: DEVNAME unspecified 04:59:19 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000040000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:19 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xb8490000}, 0x0) 04:59:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3453.111459] binder: undelivered TRANSACTION_ERROR: 29201 [ 3453.139814] CUSE: DEVNAME unspecified 04:59:19 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000]}) 04:59:19 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001100)='/dev/uinput\x00', 0x18001, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000011c0)=0x14) sendmsg$can_raw(r0, &(0x7f0000001300)={&(0x7f0000001200)={0x1d, r1}, 0x10, &(0x7f00000012c0)={&(0x7f0000001240)=@canfd={{0x3, 0x7, 0xff, 0xfffffffffffffff7}, 0x31, 0x1, 0x0, 0x0, "4ab8162b68a772606b0ff1d0032664cbe985efb8341525311efdc90150959cfc7bc24f7e8898d3d9cfe563141319ab4251b120cde6b8529e9887f97f7ba5e28b"}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8000) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x7fff, 0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f00000000c0)={@host=0x2}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r4, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r4, &(0x7f0000000000)={0x50, 0x0, 0x20000000000001, @fuse_init_out={0x7, 0x1b, 0xe2, 0x1, 0x40000, 0x1f, 0x100000001, 0x4}}, 0x50) 04:59:19 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2f00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3453.216400] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3453.225050] tc_dump_action: action bad kind [ 3453.231369] binder: 13660:13661 got transaction with invalid offsets ptr [ 3453.247330] binder: 13660:13661 transaction failed 29201/-14, size 0-9 line 2995 04:59:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3453.297909] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000700000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48}, 0x0) [ 3453.367499] binder: undelivered TRANSACTION_ERROR: 29201 [ 3453.453818] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3453.462440] tc_dump_action: action bad kind [ 3453.467492] binder: 13689:13691 got transaction with invalid offsets ptr [ 3453.486734] binder: 13689:13691 transaction failed 29201/-14, size 0-9 line 2995 [ 3453.517916] binder: undelivered TRANSACTION_ERROR: 29201 04:59:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00]}) 04:59:20 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000400", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:20 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000000)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000011c0)=0xe8) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000001280)={0xaa, 0x66}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000012c0)={{{@in6=@dev, @in6=@ipv4}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f00000013c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000001200)={@dev={0xfe, 0x80, [], 0x13}, @local={0xfe, 0x80, [], 0xaa}, @empty, 0x6d1, 0x1ff, 0x3e3, 0x400, 0x1, 0x0, r2}) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000ffefffffff7f0000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:20 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2900000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:20 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) [ 3453.890069] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3453.898684] tc_dump_action: action bad kind [ 3453.911892] binder: 13705:13706 got transaction with invalid offsets ptr 04:59:20 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1b000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3453.937434] CUSE: DEVNAME unspecified [ 3453.943221] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3453.949997] binder: 13705:13706 transaction failed 29201/-14, size 0-9 line 2995 04:59:20 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000]}) 04:59:20 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3453.996190] CUSE: DEVNAME unspecified 04:59:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) 04:59:20 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000006c00000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:20 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x36000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3454.102334] tc_dump_action: action bad kind [ 3454.108221] binder: undelivered TRANSACTION_ERROR: 29201 [ 3454.152383] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3454.189132] binder: 13747:13748 got transaction with invalid offsets ptr [ 3454.201911] CUSE: DEVNAME unspecified [ 3454.222931] binder: 13747:13748 transaction failed 29201/-14, size 0-9 line 2995 [ 3454.298358] binder: undelivered TRANSACTION_ERROR: 29201 04:59:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}) 04:59:21 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x300000000000000}, 0x0) 04:59:21 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:21 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:21 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)={0x12, 0x1, 0x4, @fuse_notify_poll_wakeup_out={0x6}}, 0x54) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f00000011c0)=""/4096) r2 = add_key(&(0x7f0000002500)='encrypted\x00', &(0x7f0000002540)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000002580)="69fb1b1c421d7a164181556d8ce3479bc3ebcfeb8bb3", 0x16, 0xfffffffffffffff9) request_key(&(0x7f0000002600)='user\x00', &(0x7f0000002640)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000024c0)='/dev/cuse\x00', r2) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) r3 = request_key(&(0x7f0000002380)='trusted\x00', &(0x7f00000023c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000002400)='/dev/cuse\x00', 0xffffffffffffffff) add_key(&(0x7f0000002240)='big_key\x00', &(0x7f0000002280)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000022c0)="4026175957b0ac52490f0591248ab8dcb80bb4a07d1b6dd1ac4d1a0a6380663f55ab61399a85203b8bb910dfd1104acf2b7a7c54eb502fe915115cb434ef90c26fffdd6075dee843a58eccdb7c50f0f74efb80851b520689c4e32f5e6afb777926c06930656bab8f89f26c9ca38c3b734944afe34921db955eca6ba1aaaab3a093003214655737f5872e2553d111f2d1ec06a8", 0x93, r3) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f0000000080)=r1) getsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, &(0x7f00000000c0)=0xfff, &(0x7f00000021c0)=0x2) memfd_create(&(0x7f0000002200)='loselinuxeth1proc)\x00', 0x2) 04:59:21 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2b000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:21 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000500000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3454.808643] nla_parse: 1 callbacks suppressed [ 3454.808652] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3454.821850] tc_dump_action: action bad kind [ 3454.832869] binder: 13767:13775 got transaction with invalid offsets ptr 04:59:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}) 04:59:21 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2600}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3454.859008] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3454.869217] CUSE: DEVNAME unspecified [ 3454.871066] binder: 13767:13775 transaction failed 29201/-14, size 0-9 line 2995 [ 3454.895065] CUSE: DEVNAME unspecified 04:59:21 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000feffff0700", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:21 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:21 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x5000000}, 0x0) 04:59:21 executing program 2: r0 = socket$inet6(0xa, 0x7, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") openat$uinput(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/uinput\x00', 0x80000, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKROTATIONAL(r1, 0x127e, &(0x7f00000000c0)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) getsockname$inet6(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, @remote}, &(0x7f0000000040)=0x1c) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000000000007ab41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}) 04:59:21 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2c00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3455.004899] binder: undelivered TRANSACTION_ERROR: 29201 [ 3455.068943] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3455.077642] tc_dump_action: action bad kind [ 3455.082609] binder: 13808:13810 got transaction with invalid offsets ptr 04:59:21 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) [ 3455.110239] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3455.114442] binder: 13808:13810 transaction failed 29201/-14, size 0-9 line 2995 [ 3455.231372] CUSE: DEVNAME unspecified [ 3455.272068] binder: undelivered TRANSACTION_ERROR: 29201 [ 3455.299532] CUSE: DEVNAME unspecified 04:59:22 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:22 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1800}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:22 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}) 04:59:22 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:22 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000000)=""/146, &(0x7f00000000c0)=0x92) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0xfffffe1f) 04:59:22 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x600}, 0x0) 04:59:22 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000000074b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:22 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) [ 3455.719490] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3455.728132] tc_dump_action: action bad kind [ 3455.737694] binder: 13838:13846 got transaction with invalid offsets ptr [ 3455.750260] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3455.757013] binder: 13838:13846 transaction failed 29201/-14, size 0-9 line 2995 04:59:22 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3b00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:22 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:22 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:22 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f4819307b5902d8a91dd32e796689a7c0dd3cd03a4b0a7c35b482b6ed2c0f74000000000000000000dd903c73ac7f7f2d0ba89918c8"], 0x58) 04:59:22 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000007000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:22 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x300}, 0x0) [ 3455.846961] binder: undelivered TRANSACTION_ERROR: 29201 [ 3455.922204] binder: 13872:13874 got transaction with invalid offsets ptr [ 3455.958269] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3455.966941] tc_dump_action: action bad kind 04:59:22 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3400000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3455.970685] binder: 13872:13874 transaction failed 29201/-14, size 0-9 line 2995 [ 3455.979187] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3456.004344] CUSE: DEVNAME unspecified [ 3456.023186] CUSE: DEVNAME unspecified [ 3456.093247] binder: undelivered TRANSACTION_ERROR: 29201 04:59:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}) 04:59:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:23 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000000000000000}, 0x0) 04:59:23 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x58) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r1, 0xc0045520, &(0x7f0000000040)=0xeafb) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:23 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x8000000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:23 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000680000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3456.625912] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3456.634514] tc_dump_action: action bad kind [ 3456.642550] binder: 13899:13902 got transaction with invalid offsets ptr [ 3456.658311] CUSE: DEVNAME unspecified 04:59:23 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x19000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}) 04:59:23 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6800}, 0x0) [ 3456.677695] binder: 13899:13902 transaction failed 29201/-14, size 0-9 line 2995 [ 3456.685526] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3456.690733] CUSE: DEVNAME unspecified 04:59:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:23 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74d7631b8a710e8610d42722a5c8fa15053c5c68f5dab75d1f61ed1c6b095fad6bbbb0fa927a7bf5e1267eff26929fe57687c077adc1fa7be0470b1ab51b9a7f453fc4c9b06932b60c418660c416eef988feae17f9cc92c88c9bc4b9091926e9d37ba710c56fd6b917f54ece0450547094331cc62041452ba0e24061a39e8e3694b543fa92cc1513fc2620896ece4a0a5bb9f9286a1c109fc715db96a6c44a35bf7a07"], 0x58) 04:59:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000907000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3456.769222] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3456.777836] tc_dump_action: action bad kind [ 3456.798325] binder: undelivered TRANSACTION_ERROR: 29201 [ 3456.861105] binder: 13941:13943 got transaction with invalid offsets ptr [ 3456.887211] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3456.890036] CUSE: DEVNAME unspecified [ 3456.899413] binder: 13941:13943 transaction failed 29201/-14, size 0-9 line 2995 [ 3456.910603] CUSE: DEVNAME unspecified [ 3456.982883] binder: undelivered TRANSACTION_ERROR: 29201 04:59:24 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3d000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}) 04:59:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:24 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x2) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) r2 = getpid() r3 = gettid() tgkill(r2, r3, 0x5) setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f0000001280)={0x60e, {{0x2, 0x4e23, @multicast1=0xe0000001}}, {{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}}}, 0x108) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000000)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast2}}, &(0x7f00000011c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000001200)={@loopback={0x0, 0x1}, @dev={0xfe, 0x80, [], 0x1f}, @loopback={0x0, 0x1}, 0x2, 0x1, 0x2, 0x400, 0x6, 0x80000200, r4}) write$fuse(r1, &(0x7f00000013c0)=ANY=[], 0xfffffffffffffc77) 04:59:24 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 04:59:24 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:24 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:24 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000007300000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:24 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3457.525353] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3457.534054] tc_dump_action: action bad kind [ 3457.541680] binder: 13963:13972 got transaction with invalid offsets ptr [ 3457.561272] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:24 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1a00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:24 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}) [ 3457.583660] binder: 13963:13972 transaction failed 29201/-14, size 0-9 line 2995 04:59:24 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ftruncate(r0, 0x9) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f00000011c0)=ANY=[@ANYBLOB="9cbd899ae56ed8b5cdb4f832afd186170ce257955294ac6db5690df42aa485db7202bbd2faf89f1ee18a11a32759070066ca1e8be12d9cea92219db4835a23b98fd99ea5e20e3b86ec80b91d7eec72c5ad0c82569d9598628866e0e6191a124b6923db21875ca76c77f07cd54f601622c3aaab4ee2cba18fe98810c6b9e757b7b6381e43ea7899b37f28aaf093796ee32ff178f017a39a99ffe9c0aed78b955242013e2f85f281840248b38bf2c393ea47cb9fd06802cf9c494a38ffebeb58ab2fcebb3be09836a553658ecb30554106d28d8cd53f18fb7efadfa0d8a252704a4a73f27d3d1a2bfbc3f8fb7b8640cd2c79fb4098ebbd5cbbbb95406b6eb9b1aaf0e24e4c35a3c608e9787a2e3cc2ecf559b6bcd085b732d87b7599b2568dbd6a9213471d27d3104e480bdaad93fa8819cb039c6ca6f89ce4f4c2a369588bbd700a39eebbf9ca7baa3b34a7a05dede4cca803e827fc5d7f35a8c53ad01f6540ae48674ae39944a62c5c18a7e96b424dafbc092be9c5b5f4227346453a58ea8ec33e75274780a86f63c9bed7fb5a3bc9d407528d96845e9b6229ccc24347c227dfd3b8766210ffea1fc632726f246c581433aa075250517e07a09df0e1b0eb279ad12ac9a6b69dc761555476a281aafd92dac341f7f23d7df61b059ddecbcf297dd18c27a11f39cad6665a4a829823f4876f68981357e6968c123791a87953e9b2d051de6f34", @ANYBLOB="31c6629f4126e5dd04301b8edbd5278230839d013879ad6830f4d508f904f3e55a2681", @ANYRES32=r1, @ANYBLOB="c60af49675be5b9b6f24182287555ff0bff99a8e0d55c451e7888b2132565b3d2395b9d0ba89ed3f651df73217dbe5e99c3be4f6c94fd75033df1d71ad65b88ec88d17df3876486c9858c39124d3009b8dc583788164d4e5e7e6f948797e54994ec88b601ed161fc94f32b9752145dba8e4536753104186859b4302ce352e497a4be2148f7259ba93f7167ae16b0cad0c865e34893870e2374dfb9cc69cbb19b8aa65b3f53d68054cc8bd3554047b0970f09474bdcdd8be0c25e045e799ce56e139381df0a03b42895f3838a56390846d8f7d49b0a104d7379af02583ae047df57dff802aa14da5fd5c75fbf29ea9a4fc25796c2a2e6e8795a28d0902edb5d9e077a917768c4e85b7918d39931d473834145039cb532397714cff930c058fb5f14b348e788444c3ed3d8d24f10cb730e96e6f169c1c62e30ddb78b32c16e7299eb5580af54569a1070f9663d53c23f68c0b5cc1a96094792e7fd567e0ca5b9446867daa68c00c6456426c1ba5123f57b9db5751e23b9b1a282c44f358243117bbcfafde32628e1481f00430903447e871b6259e20c089a3addf8f795cc89020966c01d2aa68bfc2e6fb0d6e1826c82179e84e44687355728173f02c62b9d2e895794bd7615e4201d4d4496075f459f14a5d37ae0c0cceb6fd80aeaf06bad68baaaf7e06b16b31548fe549fddf232d1543bae721fac744a13f129c977e9ce781f94c580e95bc0155c35ee029c0e991f54d69c4c9440a50130b034b3d1c1df76c50378c147b9d469e2a6de7c043888b55b5c37e40f4a27857323b1dc026a9ea6483619167406c2ffa7dd45e77f07ca68768dd1b0a730b4108ed751848047865a0572b44c41d8f1a4b6b7001fded46b95783d02f5e7fc5151aecdef48f410ad60181157852fa810f816bf7af66610682daeb7a1f0c632fd7914273d72f16fbbd247143342915855743393a18a1c69cd258fcfe9389f8f7b71e31568f8505fd606d1df29e50318e832ec1b43d654da8957bdcf8e0aee7b2e4c79d27d70795944dd44d3c61b72065b762be140b801a0357d30208e4073f324d78a28b72009a9a3cd5bfb96edc6f52cc9179ec47e0abf9a668828dc115dc6e6a0d7ba394c7b38f40732e7577b5798f4cd962334bf0a0bc9254ebcd714cc580648e392a837b6e580670c3b55398e2324875b3b827006ec05ee699fccdbb95bef3c59cfaed6155a64686ff11e49196b18108aa7abebb555bb099b4b765102741268b985b031e037cfcaaa2c86ea7e2c498f2586a03f58bf84bbf7fe02c047f6d640d5cd4badb8d4830118043750451dcc0de90e8e7bc5b3ae2492fde14ed89a9fe75c30e91f96c223118ef7a990c5a055c1d50ad7224a735452a386554808bcc98bb5b06a785998ec0414b7cd7130175d766c7a168773bdd7cbf9a62ca9287aa1965323d8d6858ba23fe4f03db8e7ffef53463afe98a2762cba6be0dfdd75fc4d54e056a08baaa8ee24be1ce6532641e604ed1b5041acc1d809ad0562383c248364a6a00e242ab87484d0469c432a7f6d4f4737328629e8b6d4a3baad74e6026e38798505f95ad56525832f20b53779704b7247d24be4af79b83e0b3eb389be6d49c0be5b7dad94cb810d140cbe0bd7def50f9702b56968ec2b27e1109534a6b2bdb3d662a2aaf766ccf2111577c709f57e1e1bb5cab4823df98feab4df80f92e5be53b930ec34c0db49647492326ca3f569e5c50c8f401589c4f90ec918d17f2038ec553cb33f8d46c63fb0c84f019b4e04b2fa6d189c1c59abbb6a793a42e90729eaaec07f62f901fe02ce9bd017eefd429f4adf53f53b0320fce29dd476370d268ae334ff8797cfd9a95c5e3f55e2f3970242df56634ffabf44c27d5ce548e60d66b8cc99bf09f1ddc7421d43e979baf45e6590fc55f35a4a45e8610364e56f877fe573b30cdb612d03aa8746a12cb85d63e030fb8f43bee4d5f407d7c1d194806ab944e84d8b7aca09687954b7e8b036cf47d658877ba1a3de528d9161120c187b8ceb99be9d0f9667c1b9fb9592d0df83546698fafe5d06cbfedced3b6464f4ecdf1cb2519eaaceaad33ce4b990ab802912649637e55a9ff0c984b973933f8dc4f8d30ffc3cc02c8d57b6abed7a6178a2e05ac8bb7b4cc6b66bc537bc7598aad96dd5ea60cc2de9ef306edb0713c7a802c25b2bba553231cc17ac258a1654c05131444b763643e2ab85eef7d9d2446dd40d07ec34ccb2084f0ddce9fbfe9e4e9db9c868d52381462c1be57ec2ccbfadbecf3008773bc98c4081d4a4fe02deed31dbdde9a689f1a95e2176d0f25a29d327697fab15d8822f2b0171d70b767acdc77c9aeb7a618f90b34b266be6321076456ed410f5de165b203cec3bacfe231a37a19a81dfcfb8b60da285258846167f8b93ff8a152be73b414f101a22792a693fe2fa03ef5d468ff8c7424474302b8972019d57b9fd229b82961bd8cb8e2ca775d0ed4de2fff63bd0ccba323752e4390de05f798eceef4e3d96ab01070945aedecd1afa3f283a6dd80de835d714578a5636091e1e30552c853d287e7decc22b5143be8ffc859ea6a65e5a18c97f804a855db084510ffb4cf164aec076fa1b20b300b047697b92f1b9175cee7549f341490ac254753ecf4ca0a5463867d9e69a5c8f4e92f17929cc5adc61fc83fb557e38113fc314b9baee8bfbf5fd07ff80b4b66c58f732e5a23b7b8930d7c9ff1d8d00a6d2fe2b7520c46320981bb4dc4f872f0208832ae7abddad3d80d5b557e2717fd8adf0853a19feae7ea5fa1af7cd86650f570c558648eae5c895b146dad69e4970de89579e322c83f09f141618c08642c6f9dae324b73bf40bead3b17bb4fbff5c3974b99493d48e6e5e1b54337b5fb5f97a0e168e55570ff78230a3e7e8c8f3456605e89c2ef65ca4eb13aa3c19445972e85abcb90f0fffc211d20f197cfb3dc5d9e67557259f703b17cdac090d4543685dbcc1212c8894b8108c3ae862be110dc97bb2a642596d7e4f09541de4dcaf1ef53320a328ae8d1f705d4c2f71f95ca7baf8e833aae5e3f6f1ec12e8bba6af8c5cb5f968ac56747af3dfdf4c5d64b1ce488dc3f4edf13958732cc6584dbb36d90fb811bccb4cd058af6ad86489fe565f0a7fbee473ec6f81e27ed88445245d4dc2547a76d37810155fa85444cae4efd4ba7cd4d7a573fc67af9137b1a89e0ae45c58fae73ee577aa6c8556368f05f516d7efb9098fd768d03797c1e485fcad99de0944624a91871383e6516aa306f3b5739f29fdc9a6a62001a4b9ce5118bbfd5945633f2c17bdaee96f53d5c59b55f6ca9257ef5491a61b9add503bc0e2dc1b03bcd67b83065c2a7d4f2090320b35a2d1dc8bb06f6a1f4fb927857087418b2c080893ed041a5745b4262dbb984b02b83d036385cfadeba58dee4a1e4ad33d0b37a78e86da51443e1fcb6b933340f46010bdb5f4a59dcb233b6ac9ea7d10757205a20966e6a7088636e876c9a986b6093d84e6e0f97bf226810744befed67d94f20be8e8a0ceb8c17e767a2e027d358d10e71e25656f6416126797e4f9815148dbed528703210d2d3f6990454ea944edd287de1bbba2160fc6115195cdbe17fda9f2d754d72d14f9b5ecffb46605c54b8a53435e50f9003d0daeee1ef108065ab1c92572e8af6f3bd1488f805caa899a86a0d3956ba0185cb30f78145c08524fd1bdc70f2b489d80ef5c491527b03f059fbd517a400164ba35d1729bfff804afa0e86ae1077f5191806d1f7e498a96e131e094b2e350cf42696e5236fff1bdfb12f9cc7295cf7ffd878d07b719889916f1acfea4165a8c5c0bcbd478d886a9421cd1ded27d4a55dbaf76433c988e2e3eedb8484bb04415578f8b065b965895ab4c5e380f9f768b6283dd26b6b85b7e289dea3f93ce84c5babd815f25d4a20982331a4fba8be9da67e5e1a3f549ab4f99c6afe230783c79705a05c1ddf085725495f43499688bfab57aae85db84141d226d68e75b4146aef7688e7134d8b35387aff4da16c6710e6fd561e3a903d0ecb0c796a0daf6d5071edd190a282e678ee5e38188128ad35a74d20945f72a412f3a3f8ab756d69428c528b140df01c54a0d1ed41f9c0bd724e890973c25a2f3ad784edae63487bd9f53463a2b7086f587e026952fb0daa0ffb8b1bd3417c245e8888d6ad911043beb1adae7c8c8a9e5a39cd3d81871ba627509ab3c5c06840e298b2e98824e4c8c8a0f0334f6da8e23ba264781a55c661799d97dad369ea69910d2beafd407bd7b2c0950cdfb7189e556b5c01c6119e512c2d58629249266c9021a3ff91ef558470d15c2bfcc2105bf2d453bc006d8d780b2a068c0cf7b64b68eafd97ce53e055ab28bbcbf6d74a201b90f2e5641881a0a082d6dd2bc73b20e40746ebe2a3f863a9720c77d46dd3a5529c8ae1a1db3fc040246887d5e48d16345616dc1ad33b490e31096239f13b5324ec93d16ef9e73eb8ddeb21865a6d4d710d460523270851c1422977ea63d2da94e6f41745dced3f6f970abd5ca881b10900e810a3a8b50f2fdb2c829c180202485ba365469f469a1bcca77140ce088d8fb335a254268831f2cbadb2dd85c0e88bdda73997999cd9e2e0a6c12a340551504fc16dc4498ad3559f337dfe43690548423cc7b2269d73d78b396688504fa22fc4852ceb07764717ede915aa1fd19101b2eec1ecb8c3fae22bc9c15ec64bf33fe1afd841bb71cfcd8423b6f2c55d40a61cb0e118c74a490cd3668e37615c0202a46f96dfa101cefc4c5becd088115bb90838ebe68a62960927d027b62908879fee068804a95e075746c4c5a5b5ece53b7eb65a25b05cfbf465dbf1c0f2337c254ac32146220d522e2e66d234d4e5a385eb0c93a7908f1938be9847b27ba0e1a6a05f5f24f54a3eb05c699a60de8ffa9f67380192cc55eab67dfcc1e20fbd14f5ec544fdab40888276e57bb7f30eb5d2e61a0779b15e4fb807bd5217437b4fabf10cb559ce01576cf1744497833a45dcf53b81369d2f39acfe1ba06be7a68c88ed119e959c3695b24843ab5f212efa9dbfc0207b406ae9e97b1a0afd61260b329b39b77e6d0818c9bd25e182f07a98696a359ca2d081ceb6c645ff720dc2fee4dd107ad21949ffd09a2e045464fffb26d5fa635a77df32efb54afed35f6f5a27c5d07cadb3c0ed2686653cde9c784fa5bf2ab07f692216a315ed3d1bd5b0055d0391584ad06060824b030d1c90a124e0d1830283ac8c3aed4050c929a70f5caaaccd7ef379ff3388b44356db58521f37d3181013a63b58b6219e43e7fedf4c450b64353d4cd15631cc0df36b21d62e10188bdc248c2f3c0651290de15ed7d5c6a7466c49fa467a53ea9f3bf84471148e1b42710328a1f840ed9d4a0f2fae4ad5eb8635cbc1fe12376fb63571fc17cb12432375f899f5d8527cbf67a84fa9f7f5d109f562e3d38a06a45637d3496faec90d0ed331182aa646d4294894c3458f9d557111e13b8db728aa0e15d3a8ae278318999bad4be0777894208689696f22f77f38c913d1ec50a1be569590d0688f6546b1ef4829f36f1fe3128b19434bac4dc0bcbedc26861eeef5514c6961a9ba672801a2e4cf74f13dc8a3f6733250d15f37cae0fca3b96bffa2ff1dc1baccbaed2e3b8be799936fd605c6bec96bd0dc0e184ba86aa986a0dd227de89f46cd330420610690431c90ac9f8b19f28e59a872cc4aa03e5551421efcbe5c5b2fb90034876080e542ebe9f63d6f1a63b2529b8e941134b067dc8d0e17774347e81f4831497b9f528120a98a0", @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYPTR, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="93c29adf41852f5b09ebf0fd1d026bb7acb0f7dc2fb7a78ed9d7612ca384be9ac1c411759f33b8852e1e73523f96f8b7465ef874204b3bf727b603b66602fa3deb47e181a7c27376f2d65de7d9bf84b42fc90842926c81370301cc032e37c0e65fe1c2e8bab075f76ce0572eb2631fe8977aa905fb8adaf0db9af7f00d5b569327a9c93638915301182aa48e8444022952981d2e73bc93dacb7d6b43f63794d203c83d3c4754bb9afe27ada1"], @ANYRES16=r0], @ANYRES32=r0], 0xfffffffffffffd4f) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000001100)=0xe884, 0x4) mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000002400)=""/169) socket$inet6(0xa, 0x80000, 0x3f) 04:59:24 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:24 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a00}, 0x0) 04:59:24 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000009300000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3457.714928] binder: undelivered TRANSACTION_ERROR: 29201 [ 3457.750652] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3457.759332] tc_dump_action: action bad kind [ 3457.780824] binder: 14002:14004 got transaction with invalid offsets ptr [ 3457.787995] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3457.796665] binder: 14002:14004 transaction failed 29201/-14, size 0-9 line 2995 [ 3457.844830] binder: undelivered TRANSACTION_ERROR: 29201 04:59:25 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2200000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800]}) 04:59:25 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:25 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000007fffffe00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:25 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x0) 04:59:25 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000048000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:25 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:25 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f407a2b32ace30323179776710700000000000") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000001400010000000000000007000000f64cf916f5967362680000000000000000b53ccfac3c48ea5a79193002d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74000000000000000000000000"], 0x58) [ 3458.389818] binder: 14023:14025 got transaction with invalid offsets ptr [ 3458.400735] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3458.409331] tc_dump_action: action bad kind [ 3458.414340] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3458.431730] binder: 14023:14025 transaction failed 29201/-14, size 0-9 line 2995 04:59:25 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 04:59:25 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3a00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:25 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:25 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000007a000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:25 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0xffffffffffffffd2, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3458.523067] binder: undelivered TRANSACTION_ERROR: 29201 04:59:25 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) [ 3458.567567] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3458.588907] binder: 14056:14057 got transaction with invalid offsets ptr 04:59:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000]}) [ 3458.644734] binder: 14056:14057 transaction failed 29201/-14, size 0-9 line 2995 [ 3458.671313] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3458.679981] tc_dump_action: action bad kind [ 3458.747813] binder: undelivered TRANSACTION_ERROR: 29201 04:59:25 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:25 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x4000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:25 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:25 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000007000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:25 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6800000000000000}, 0x0) 04:59:25 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000]}) 04:59:25 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000001100)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000001140)={0x0, 0x8}, &(0x7f00000052c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000004280)={r2, 0x102a, "1acadb53c84eaa61f5a3884c4ac2eebf8d493e0a0a20d154fd51eb9ca55e211fe82942597b495096f32c15394c5616559e721c4d53b63a0f497e1bb3826f73d6dd038b7ec784d000fc24b2879aa61439a569cb3c63fc04a437c8f1ef2493be8fba5eb7c17e68e8ed4ee9e69b66063b3cb589a86608f7edb3672157a6a822371a80e8e4499f64a3871f3a842014f443f0067ba52316d5842912f68984e604b14015f55f4194bba1ed5c778ec86941c4db32af82410dbd6f98e70db192962f93345d023dc719e41ffc45bf47ca49786f2e6b490d413eb61055bf6913af52c048c3aa1ad5d24980182f7932c6c1d6a5fb748af47ba83540ac8979496373cb1cd8684682a97bd1a339f51ca2d087b8530bb8e9b636824b64329e23990ce0d70733f9f97b0438e985ca0c88a5f148898a2ac923d1513eb7fb7eb95c2efd359f8c045ebde856b591f9e29728f06886f6d01f2fdf08ed5034bba74346415f0b72296a52afccc14ce4d260cd630fc34c2bee68c6e147f53b1f19cb11b9112d2e5d8de60ff42bebb966f217b4e5d9907b1301366ac4873a349b1e6c4325101c340b3b8f151bcf215cc1de37da7d88980a2ee3968b0357ed517f11b1bcf3fa56599893bf95685a51a27ad793d5f2329049b68ab6029df61695aeb0703133d767c11d332b407f49b841edc5769594f9dc25e355bc122729b694f8b19cc291c8a1c7edc51a4d3c106cf8ac5f6e08901cfc8d41fb4e0ae1b15236e1902da7d4b0164f02066b8672dca8b7efdb1bb33958bd9067afbdf3170ef4ff99e626825db0c83fb541aa8d3122ea6a162f277f10f54c86137f65e9a3858fa53b6b5d1cb4221c0b79e3b639f9bb5cb59ede1c9de6cf8da9cd60e8f79ceeebcc6cb5275e1f4fab69aa4c0d51f023a0718430b0be3ecf4a798474e3848110793e6fa0026033018d13eb86d7136e500602b96b1e6868d897b6db2075357ee70b8459c6826ea26f78bc9eed7250eaba186bba68fe00a6d996bc60d4cf741f11c05a99688bfbf64ad8386ceea537eb813fb6f95138906cb7f77cb6612331bb256dcf1672ef888b1d7ec2299496d108866a4b50999ef93920910b09b1a14cfdbf5179b61bf8561542af93bcd530ac0d1e796c1a008c73661c7a60c77235d7cf7f1de66dff31da1c4d071051b073670dede13e7fb2159fb523719fe4b0b63582acca1faac3b9a0c8736818a2ece7ac6c4d016149746179be84aad45f849ba0f02f3da81ad17d4036f3af65b10159e273a026d45137c1af03109735f3d51631224162576c02e90ded3c04ea0589d2a06dd8c60a3852382b509b8884e30ab5b61c5ba03abd61af65a9c8e30ae0457325014033f057b994e67e66bba4ab06b35498e0f638858579b812d307f44a46e3c3a00bca264db11c70d587c5eb3aa25869bf25b6dad466955da088ec03b845773e00dc812ead4d4d6d102428aca6c0209928f5d8ea5d015591f48f7a299ec84709a74f61cc514af0eb88a58c651e73d8cda223b3271d8b31bf4ace50b46208b2b52088c00babe394c5d4f872ea660dc29a91c482d9f01c74a76857ea5f64fffef245eea4767f18cb4abdc500a914f1f6c85dbf83e2f1761b352ad4d3addbcb0a0d7c98e72d833584b798f38417156ef471f168a0c0ba78ba1e60cc504d779e6348530cab79879381f9023ac218696b727626fd7d0176956fec4d6ca601679a44af7278113f19d9fe95343771b16ac93c0f13ec0ca0a57e17b33529cf66f1b858a37838517a683544b8885c4d8c682ecb65d4194a39c74f114f72639ab07111b6c7bac5286f46f3cefe36383fc8232d7af5250c61daf430bcefdc89e1c79a18110b54416093525c02fc6b8a4cdafd6d3c671a68a9fb34dc45e73561def853c3abc34fe2daad78551b9d77424a93fab6246dda8e58d77d9a6b20e352bb9b7ffcdfcb21fb0fd2738e16adc8f962f311064cfcb197685b92786ee18c6c58bd7f459e03e7d62b9ee37de98252a5359b1f10a2da8c9a7f542cb410a104a004d6c788d6025ed2a71f72d0177042d26b35fe2dd4e5f41e2c553c4034496c6a5265055018dec4275ec676d70e2d71f8410685023b34dfaf212c1196193489e49d23b2c3abafb03ac15dd8672e1ac3cd5fc33c07ea7ae4da90be7c524331f48d4753153bcf383d9a24828cff7b62eafae77ebb27c8d2225a00e5d0f55878c619421f0d96537c3659fdb99388173a55982e8cce4d6da9eb4a79e618cc1514d0737e9721e131dd72e48ff6ac504d1a6ffb4c199aac2d6ae905bdae140eb3bb26644502d971f5254a5bbd0625ca077c440cff615ca09608c1fae66cd3c9200a3d422200bb580ff34c1363baa58363f78618d27731571340279bfe4929153d34502f3dc88ed1c5c3624da52b38c17ae599768a6ae4892367c6e0ac973ce77880c72c31d034fd201ad49995ac6e078bf20e6d146756fc19759d480a4f3d920d380244a51cd1900fb8cdc6dca461964db2280efbb291a7359c1850fb7cd692868fe7141ad6629f4f3d8790531752fe4b45ecc9cf91fb4e19ffd73a4b349a19bfce8b8cb038cbace84aa5676942f9a238ab3c4c6425fe1f4526f1e5e23dc5e21b5c849d711dffe6c6ec4705f7bc1e5646bea0bf7e0aabbe2a5173e730117503a1e30ce9f4652c693054671b32ac35b237e2bae40626d4997a6daceb49218d38c8d6c58b948a1c206ef8bf295bf50e9796ea6a98586511263adc1a62230149769e45b2b4769bc3387eb33f9f51ba2523c6a4e15e3754120a67c3554563d5b21f2552944079292042d680f9d2b13df42724dde8175f672b93acf400014cc9e6edcc27145fde37e0c52c736a9c524c1a0959723752522ce4c23b68a9936ebf706e4ded03c861524919043685445cb4e590588647b8b0be1bab01d766761d9481127126285dc1109881515433b6ea6c60acb0d90315714d5b7d7093fa55a22aa0d10a67c6001ac4e93a272fa1d6bf72fb42345f8e782ab87014229525849f1b3faa56c1208bba658867e6f323964230f646f9f95cd203368439ff83d09d742f65c93a4e1d107c34b2a2e7e7179836c307a604ddea95fe12213d02a0d5320eeaecbae8e405da94a47eacd268470368e0b05d845201d818bc9d9caa74d88afb0ec14aeece21266b37b66eabfdcb1640494286e8465dd2839c2adc9ae57445e515f799aa87d46f3031de5debbf35279c4a1210020a5b658f1cff6f97f136cde9f87753cad458d1c9dd97c94c5ecf70741b56ac55c66ecaf592227e16245159ddf1605497e3795626c42572a71b4d04be27e3bfa47f5f2ba2672c6912610c017cc711c242fe8b2b236c00ed24a53012a69da7766490f6ad14349a4bda766d2966138a4d4080a5fa2fcf692f9bd48b5a403bb557a6428af01db6b4a167bd2e6fcbdc4ab61584a40c0acee36c83a5eb3ae06ed29d75779b81357b54f8c9d9ccf9d5fba52303897b5bb2fdf9e72949a5cdef2c40327988a483e43f63a9fd464f7714dde45140913bf53e4525cef1118f0a3631c0f82da9b2284d3fd130dc58e91538cd820b5caed1f15c9fbd99d55a0fcf3bf4ad8e8415202cd54257193905225829e6c1b155b5bed20052547e22d69188880f1c3df8ac339026dbe8fe8ca1a43346273a7bffe907e7f416d4f8ff10f60297d218853180fbd8be5158d266a71c99cda514b0e6b8de3d62832c59dc7cfd5f4d97d16b357a50de57082f3b55ce399ed1160bf564675957ff5e4e9e825fbbc9dd4ca3e3d4883855b84b7b6a06014ba8eec24d277dcea04c01b53805f69b7319dc2b89fa8f189af85a664b53007efb8d65803fdc043c77b5451eb57b276aaf8c6cd13dda839102a51423111b7d4ece45e82ed797f49a135fe86ca74a9d21dd92a70b24dd4b9c643e2bc27e2451c1af03399bfbfb464ab92f5d00e2b817f3f01fd9407387e94743d0047dddbf39ab8d1eb927af957389efb4d154ee2a8180098a38d9434603568ed78e9deefef2fa618c96495a0b0b1ad39ec7dc4a94fc58b8e47c88ae23c25dbc8a841ef36fde7356dc188e6bc30d05f02c099cae43929ccfb9e4e0b517ba411d6d5962f2c34a1349e758c5eb9b3f8d4b19bbefd17b9a253eaeba27c360bbd2324fe921dc65c2d3b998bb3ea03bc74edf5f1adebd2286530609cfd281f1a6ddfa42b42e1e4a67029cf0e1eeedcbf81b43bd655a5370f93090a12b0cf7a46dfae98beae06a90f29594169ff61e7d5a288c32757d53adf008a90e809e857dda7f8a31159d0e0e07cc91a86ef1c13962d2a96f0d0e2f02ca3dfb8f710b397072e1ccefaab1f8ac91e4ecc51a7f64761064a3f6cefe650608de787c4afa5a281e170cd4f434feeb71d1f71e681d2b84d73f4ccc1cb36bdf10820597bd574187b4be4220de980d26ece56ef0b2ff940ad1944f182a41b7c8caed4392d0c51defd82e31c66e61b5e849b4f4f99fa6910acc79141ec0aee1159adc9cd1f67403e348721d72f5a3ee5e1d3e5885d5f4a3c24ac3ba2666be1adc75b9d6506bd3c3d2bcc2269db172b124caa2edd3afe48367aa851a5dc6e087fbc66462e987b259224648f99bc69495a83f33cf62b736015c0cc751e9ea387fecefad5e716243daf306937d447df0e859af3bb198d0cec5034c7acc8ce64da304a97be56dd4f8eb5052fcca03d558623080c5ca6010b1e83eacea96120e602c2017417058975859e7081209b71ae01ae255d62460aa21924ec23276f5419c7e9c0d4e639f298cfa76213c7e778f9bd8bda1bf853e33b85388d26eed9f20c151241adc04483026867d52156453960700f073570bfdb97f5b9079c8e3021b5c8b3769523e2dd2e3ec95615a51a2bcaeadd40ffb68331a507f0ffd1b10e44e3f37eab7d623d40d8318651f064d3e45592df850cc95eeded697d0d7adee2f3960b543c19a5bd1b464fb3da9c8f374bfb8a4d20f104cbbaf724d98af9262b48b97102fcd7ee189897a97bd2e3f163b0bc69d42bfa84619af037fa141e5f297233b126eadb545816b51bf6ce046bd80ba04980a07456bc65cc1c3e46b95ba2f5d28c95b611167f56d07565538967580f278f01fb5ab57104fb6d5b40f94457e356d8e0aebffe5a4ff2f9f6ccd4d638c934faa86689ef7d290ebc65d49cbab8b86be9ea2fa9d4ff74a6c29c6699e5d9751186de20907a21fc7959c97e2f50b3352fc0e09cfebd356f713a779a8859cd7371948fc096170a74afe68c4d5ad276e56278ebd561492258a5cd834cd403bef7d5c6624d025c6d5d3a28eeaf96e1f7780fd21f7e6935e65b3fcc670fe09745c91ef48fef7b593fb77466fc8b7bde6b323a1cd3eaeabe1432fb256950bcd04575879f62e6e2503b67e2d3de280e9657cf925a313fb95f8b1ed73d53b646882a30ad560dd119b89f465eeb86af2fba3836142ff5e6f6a2ff378b5e40a2d653180c4f3d1098f30731f2c6f63621c8a805fb97164dfcc141dba5429a9db478dd9c26f1ec73d459c98b573c432ebe799d949da365454024d0ccb08003c185914ce80e4e9ee1e68c5fe5fa832abd6b000b06bf77e39842479603977217ca5a9ebad26146cdf63e0f34c7d788a626aab1f7bdd74b6b5554b6c009a3445748a005325b6092ee5307ddb53c6dedee4aaa2bbe05bb0ce808100d56df7fb5a1fe0ff5ec2b67e81ed944ef19018e50f8c3f38e10c8fb91c27b25136e366de64dcd0230860a262d075dd3917defc94afc253b11cb253979064ad0491fa113a97935de9cd28abd5261ef3df9183d71331a51a944e72405b9a6e14688d8e61a8ae13432ca9ae454f30cfbb6b66ff87e36c2681a3e4e89dee307b8aafef4dd58c3aef6ae293a276"}, &(0x7f0000000000)=0x1032) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r3, 0x17b6}, &(0x7f0000000080)=0x8) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f00000011c0)={0x800, 0x6, 0x1}) write$fuse(r1, &(0x7f0000002200)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f743d58612b6132e56f633c05140e6fbb25df65c64e949c8f19bc18d4239f8770ba"], 0x58) [ 3459.301457] binder: 14084:14086 got transaction with invalid offsets ptr [ 3459.314333] tc_dump_action: action bad kind 04:59:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd000000]}) 04:59:26 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3459.342999] binder: 14084:14086 transaction failed 29201/-14, size 0-9 line 2995 [ 3459.351564] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:26 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf00}, 0x0) 04:59:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3459.428893] CUSE: DEVNAME unspecified 04:59:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000006000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:26 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3459.470579] binder: undelivered TRANSACTION_ERROR: 29201 [ 3459.490361] tc_dump_action: action bad kind [ 3459.494520] CUSE: DEVNAME unspecified 04:59:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}) 04:59:26 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2400}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3459.538232] binder: 14120:14121 got transaction with invalid offsets ptr [ 3459.579876] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3459.589227] binder: 14120:14121 transaction failed 29201/-14, size 0-9 line 2995 [ 3459.707694] binder: undelivered TRANSACTION_ERROR: 29201 04:59:26 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x3}, 0x0) 04:59:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}) 04:59:26 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:26 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:26 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2c}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000006c000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:26 executing program 2: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x4002) pread64(r0, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r0, &(0x7f0000001100)=ANY=[@ANYBLOB="b15398becc85df5f01000000edffffff07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000021c0)={r0, 0x0, 0xb3, 0x1000, &(0x7f0000000040)="c8818dcc0845a8a8f71e04873ef737d34ef543b65daf29ab4cbf10d70a68e484c72ae31f199992040a44c3b950ff5591bc5c5961a0e672350e0291c58b27392bd7a6ad7b07b0bfb1ca69afb981c41b40930f2e5343dc2fd25f5f9e107c7e83f1bf9d240ed5287bd64dd0afc6ca618d1e71988e0de09407207ab7d480a4efe8dbca62a46eec863a1548c86a024d35ded999291c1913b1d9005be0bc67fb7a0b10e002dec99158854581733f6b010d090ec213fc", &(0x7f00000011c0)=""/4096, 0x80}, 0x28) [ 3460.236834] nla_parse: 2 callbacks suppressed [ 3460.236844] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3460.249977] tc_dump_action: action bad kind [ 3460.261441] binder: 14148:14149 got transaction with invalid offsets ptr 04:59:26 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) 04:59:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:27 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2e00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3460.288256] binder: 14148:14149 transaction failed 29201/-14, size 0-9 line 2995 04:59:27 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/cuse\x00', 0x102, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="580000e8dc6c57093d0000000000010000000000000107000000f64cf916f596736268914abd0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a3c35b482b6ed2c0f74"], 0x58) 04:59:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x900000000000000}, 0x0) 04:59:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000060000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000]}) [ 3460.394994] binder: undelivered TRANSACTION_ERROR: 29201 [ 3460.460392] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3460.463356] binder: 14187:14188 got transaction with invalid offsets ptr [ 3460.469042] tc_dump_action: action bad kind [ 3460.542770] binder: 14187:14188 transaction failed 29201/-14, size 0-9 line 2995 [ 3460.610520] binder: undelivered TRANSACTION_ERROR: 29201 04:59:27 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x37000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 04:59:27 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x80000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000011c0)={0x0}, &(0x7f0000001200)=0xc) syz_open_procfs(r3, &(0x7f0000001240)='wchan\x00') pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000080)=""/121) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000)=0xe3ef, 0x4) 04:59:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:27 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) 04:59:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000030000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3461.141952] binder: 14207:14212 got transaction with invalid offsets ptr [ 3461.149317] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3461.157904] tc_dump_action: action bad kind [ 3461.180376] binder: 14207:14212 transaction failed 29201/-14, size 0-9 line 2995 04:59:27 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2d00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:27 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}) [ 3461.195384] xt_check_match: 2 callbacks suppressed [ 3461.195397] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000007a0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3461.257821] CUSE: DEVNAME unspecified [ 3461.266291] binder: undelivered TRANSACTION_ERROR: 29201 04:59:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a}, 0x0) 04:59:28 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}) 04:59:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3900}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3461.310737] CUSE: DEVNAME unspecified [ 3461.318882] binder: 14234:14235 got transaction with invalid offsets ptr [ 3461.349459] binder: 14234:14235 transaction failed 29201/-14, size 0-9 line 2995 04:59:28 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596906268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce6389d3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) [ 3461.381713] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3461.390353] tc_dump_action: action bad kind [ 3461.472149] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3461.480644] binder: undelivered TRANSACTION_ERROR: 29201 [ 3461.531967] CUSE: DEVNAME unspecified [ 3461.548632] CUSE: DEVNAME unspecified 04:59:28 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:28 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 04:59:28 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000740000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) 04:59:28 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x30}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:28 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = accept(r0, 0x0, &(0x7f0000000000)) mmap$xdp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000000, 0x44050, r1, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f00000011c0)=""/4096, 0x1302, 0xfffffffffffffffc) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3462.040672] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3462.049371] tc_dump_action: action bad kind [ 3462.054476] binder: 14268:14280 got transaction with invalid offsets ptr [ 3462.075135] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2400000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}) 04:59:28 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2442, 0x0) sendto$inet6(r0, &(0x7f0000000040)="7b57c24a7bd09d4f324d9cd2518e98ccb92c95778a5866c548f85c543049174cd709beaf43ff50e04d377c4ca7dca5e30d169726d5e3517527b790efd87ae3c523eb8b5f869da6bdd9afba0758fe764ffb1ad5808b7ea47151b4530b8f3ea08269cf955303de07956a5f0311d225e8d58e72111798623686ecf145da4a1701a600e8e3a4f98043a37cb6ce8fd18a8e4f2a51", 0x92, 0x10, &(0x7f00000011c0)={0xa, 0x4e24, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x1}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000001200)={[0x401, 0x1, 0x7, 0x7, 0x1, 0x7fff, 0x39, 0xe0, 0x1, 0xc11, 0x4, 0x4, 0x8, 0x200, 0x10001], 0x1000, 0x400}) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:28 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3462.088637] binder: 14268:14280 transaction failed 29201/-14, size 0-9 line 2995 04:59:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:28 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000105000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:28 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc00e}, 0x0) [ 3462.189207] binder: undelivered TRANSACTION_ERROR: 29201 [ 3462.242589] CUSE: DEVNAME unspecified [ 3462.270716] binder: 14305:14307 got transaction with invalid offsets ptr [ 3462.286300] binder: 14305:14307 transaction failed 29201/-14, size 0-9 line 2995 [ 3462.301645] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3462.312709] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3462.321386] tc_dump_action: action bad kind [ 3462.366575] binder: undelivered TRANSACTION_ERROR: 29201 04:59:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}) 04:59:29 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1a00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:29 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x280040, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000040)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cdf16f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) 04:59:29 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000007fffffff000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:29 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x68}, 0x0) 04:59:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:29 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3462.922368] binder: 14326:14327 got transaction with invalid offsets ptr [ 3462.945691] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3462.954345] tc_dump_action: action bad kind 04:59:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}) 04:59:29 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2700000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3462.974473] binder: 14326:14327 transaction failed 29201/-14, size 0-9 line 2995 [ 3462.998397] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:29 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000930000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:29 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7400}, 0x0) 04:59:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3463.060321] CUSE: DEVNAME unspecified [ 3463.064607] binder: undelivered TRANSACTION_ERROR: 29201 [ 3463.087541] CUSE: DEVNAME unspecified 04:59:29 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x10001, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3463.159205] binder: 14357:14358 got transaction with invalid offsets ptr [ 3463.176680] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3463.185604] tc_dump_action: action bad kind 04:59:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) 04:59:29 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3200000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3463.202224] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3463.207228] binder: 14357:14358 transaction failed 29201/-14, size 0-9 line 2995 04:59:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:30 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6c00}, 0x0) [ 3463.318954] CUSE: DEVNAME unspecified 04:59:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000]}) 04:59:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1b00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3463.360913] CUSE: DEVNAME unspecified [ 3463.375401] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3463.391322] binder: undelivered TRANSACTION_ERROR: 29201 [ 3463.396903] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3463.405530] tc_dump_action: action bad kind 04:59:30 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000006c0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:30 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") poll(&(0x7f0000000000), 0x0, 0x1000) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000001240)={0x0, 0x68, "200f6b6b66437c1a3fce2568b74f7e2310e223809cd817c28de5fb99f496720a664bbbabf6411ba3074ed64c870125faeeb03f1b6a826d1e5f95514eee7bd6bbce1047e9e5975a39700e6b7ccb134472468672f90e0e0ad3c7fed56703a356336f77f5ccbfff15f0"}, &(0x7f0000000000)=0x70) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000012c0)={r2, 0xb3}, &(0x7f0000001300)=0x8) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001340)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000001200)=0x105000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x6c, "d8d194edb723d4d13791578576f00972ca5cdd14bb8d2ac3ecbb419a5a7d2abe421252baab9e385cedc0a49e74b7564389aedefe458e93bd3b7bc9839c6c77e5f89f66cd458b96e3307cbe0fdbfa3544b9632b8fecdfc8b954c42c125dce8f91365e099ded0e62ab6f804311"}, &(0x7f00000000c0)=0x74) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000011c0)={0x2, 0x8, 0x2, 0x10000, 0x7fff, 0x8, 0x2e39, 0x546, r3}, 0x20) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:30 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) 04:59:30 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000600", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1f00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}) 04:59:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000]}) [ 3463.857185] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3463.865948] tc_dump_action: action bad kind [ 3463.876599] binder: 14421:14424 got transaction with invalid offsets ptr [ 3463.886400] binder: 14421:14424 transaction failed 29201/-14, size 0-9 line 2995 [ 3463.895370] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:30 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000600000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x35}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:30 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x7}, 0x0) [ 3463.934217] binder: undelivered TRANSACTION_ERROR: 29201 [ 3463.980394] binder: 14440:14441 got transaction with invalid offsets ptr [ 3464.023168] binder: 14440:14441 transaction failed 29201/-14, size 0-9 line 2995 [ 3464.041593] tc_dump_action: action bad kind [ 3464.080177] binder: undelivered TRANSACTION_ERROR: 29201 [ 3464.655527] CUSE: DEVNAME unspecified 04:59:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:31 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00]}) 04:59:31 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x27}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000709000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:31 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8100000000000000}, 0x0) 04:59:31 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="580000000000af4ff44ff62b8a66fc000001000000010000800000000012cf3ee8b53ccfbc17f25d9f40e19f04006638ac3c48ea5a851930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f7400000000000000000000000000"], 0x58) [ 3464.804252] CUSE: DEVNAME unspecified [ 3464.848626] binder: 14462:14463 got transaction with invalid offsets ptr [ 3464.862701] tc_dump_action: action bad kind [ 3464.883576] binder: 14462:14463 transaction failed 29201/-14, size 0-9 line 2995 04:59:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) [ 3464.887113] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:31 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2f000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:31 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 04:59:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:31 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000005000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3465.001426] tc_dump_action: action bad kind [ 3465.013585] binder: undelivered TRANSACTION_ERROR: 29201 [ 3465.092689] binder: 14501:14503 got transaction with invalid offsets ptr [ 3465.095482] CUSE: DEVNAME unspecified [ 3465.107164] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3465.119774] binder: 14501:14503 transaction failed 29201/-14, size 0-9 line 2995 [ 3465.152747] CUSE: DEVNAME unspecified [ 3465.196142] binder: undelivered TRANSACTION_ERROR: 29201 04:59:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}) 04:59:32 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) 04:59:32 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x3e00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:32 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000002000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:32 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:32 executing program 2: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000002400)=0x100, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) pwritev(r2, &(0x7f0000002340)=[{&(0x7f0000000080)="98f32c1e771b9402e1e8c3fad15b7ffb4921d14bc250406e6fce211a17ca6338444fe3a635", 0x25}, {&(0x7f0000001180)="5cb0228884c79e0d284072c280f5e308f24f059782bcb7a9da165aa76e5dbaf96708449d3c7b4ed2a396d322e5fca415a8b1a35652e46e7bf91ab0585c20637fb86585b0d1759ff6e8f8c4febad95eb64756734ad0e7b5156b91764bf2f942163c2086bb581bda5ccc184b49ec3007af71df8e0d137cd8c4cac87e2162c19f57d7a8bbc50c8d3212619963e9516bd4f868169da151f9f7ff40fabf12d84c70e4d9cc680e2ad4764009955299d7a90594e55644937c5021335468c90dfac5646ce67558fd6339b00639d8e71f177709144befcdf5f506a3d57d83bf82e9982c29957b2d010dab6b36d45adcad9049070773ca9b3d8727e4b84e8bda583055603e4fd11b3ea15e29aa4a8a4def72270dd5356e163e28c31898c293a86532bd77da24ab31d9fd326a5424e0629076a8d8da0e53d5e38cd867ddc79492cf6b352a387ec8c10ec1b827ea9639e9d6c01470e2a3c948a8316d4db7b876ddc097af6fd0c0ada22ef5c729d0b873e04c977afb68102bd1c5d7c39e477a2bae9c98daabde6b3ff0d6f6f91432fd3ad7ea9e2dd4e4ca1e2f2dbe1a9c3de528973850540f2a2bd78d936e10f90df0cdfd83ea202f58b5d221c6c4609d4c6b4eaa54a2d409841f08d40b5e3e2626eed5a55b75f5edad8b95c44d4d5a643b6c350975c0c7fb0842bd2785b1b473a328b78b7605164f24c06c14aaf2d7c5f716a2d5a89e69a133891a8ba9c360fe22c419734d02f09d9d3a5f75b05133dfaa4ee0f2e6fa41e369e5efe9535f61d424724cdddac516c75b24f53c1f35570c90ec180d8008923ddabbf616d0b5e8586326e865de91bc7599a74deadc268b1c602fe61c8f0b3554cc92c551cc70cf7b76f82a385eb57bb76220c64524ebad7004e7131a4faa5174637054c90d41259541de4e4e93993cf053900e9642ba64740d4cad93330a01ad8d4950ce01a25e108536a9275112af0b57819f215e7b2325649f6719f07d2c366c793b8d7ae19ebc6964b7979784aa847a63ae15e8883602f0ee6cf6071d144cc455465bd1da7f6cc6d5d01f5ae194bf631edf5f787ea9b4b49de7ca63c275fb28f1287b3e7e6817cf8d693bac51a3fd8689cead07f9e494528b8e266d12665d8312925cd9e9023a198236ff095d04552e58b3e5df59033651a831cfc772f2405dd652f64acba08ee0ebc9c59dca0f99b0a556339ef799a1a7ef00409533f2fac56ac38c8c3a4f3566ea7cd68eb7190b893ba9037a9088683d09a0906a1b2c55dc0e529f4256560195e44aa390f8832c82b6463855e6a9025cd5711db9c9c3746f1c521d57fbe24f0b47368354477ae3505691f8006ff015c9fb1369bf01827fcb0523ce1726a5f4ddd780b4b16b789447974a01643d80e6379512542f722f88efba54840ce29c68ff2bc5579434f1f816e2857419eb77bd51ee6c0970aff0beeb3bac73cd8878b7a5829b6bb484f2ceb0fb12ef409f1bb5831d38bedd805b271d8e5ed90c46200b832830e99b620014e918d7dfaa334e3da64f8babbfd1590c97ec80389793cda65f0933a8d4ddc21700c9ebfce9219098a583c07263066b4323cb3000f7fff6bb65c0624e4386d08f3424e073ddbf1afa8446dc62d0cf9b82f07924fc62db65acdb89e77a5681e38879d14a71d49963e6eeadf1cbab22355ee779cd16ed3d3e0c29453b4faf763e5d1cbc062e43e317427ff163c68f899c477516a85e69d0ea660ef434721f3ab9e59f914a48bac596a9dcf0f1cf5e03dfdb059b6158438ad2c1c585e3a6ee6c628319fe50973f7156aab5adbff96195e27f4266b1861677fcfcf3fb16be1b1fba47408b5c0beef1addd560c9b8ce8e1ba5f47ec888cd0df5c851a3bb5cf428704d68bcba44761434811f9f01e3706b0afc56a2f73a8ba2aa01413776ee68c5491bc2b774bf8b74048814446d3976a4ad9eb082945297a52385f260ebe6cc40704f2ccf17938fadb944946f3e7cf60aae453a1c781b95cdff9337cba46e6c0d525c9dba45f04566612b7550c58aeed48c2405fcbc8953c752844d1b8738f95bbbce6033ead6b0e86dee5fb2a86d182a17003c7df48926892197e2cfcc7f27da89426831f1a22eff1392870ae859f8d4c8f95f3f1318c9e10c72b8e269482c7e22f62924bd4b63eec8d2f9736a39d6fb2e0d19f6b1ba89321c061f1ec311341dc7933d5d45fb2f5078dc5f80765d5bf9e9e864c635a743193e58bb4d7c04cf7607601f791eeedc951c6931b2d8fe4417210f491e050b029fdab483dbf47b26cf8a9c5a7efa38d9331e7f2037f80de967d127cf7d8ea198130f8ed03dfb1871b5d188ae61a1885c99607bb7c5ecd9ced1f2f22802bca857e1ae7177177dc823261becd6c78a72bedab1da082086606b719e1bcb55bddf698230c71c088b42d8caf5fc30a4ac8b1b6cd0dcdc7912ad69601fedfb1343ea46b044243a65e78c9585330a428a8522551838d9ec5095f98c2182b859fa71b7dfe549e14b15829db2070d409663d63052602f6b5d980f140a5fc4016db5f62c1f37df9b675d3855213ae0ffc8ea6995e8cab63405355b2c09ddd23ef497e32c882e06d9cba2c79841078833e1896ab1439c83dc17ca6a61f4fd73c7b9d58ea32789c128b19fed47e51a4f52af2e2778f217fa861f5fcb8a8484e77ec2c5975ba05902edaed193e9cfe50c4530854e3d90a2f0d4efa9f6c9969d5bd5f776ea7e964251b22f7312e0f24f2f6baee25722cc8c72ce0088faee333e12628fce02061558ebf3017f1eff35a48d60d3401549537e0a550b8941f1f78659b68ec4f744203ef2c34dc86feeedd9bf3cbd12a6c3980004e88368d2ed9733ca7d26ba962af054bb709590bef1f6de7e2062affac71e3100bf4210a071724e3b134d42ed29f7b4e46c86e4c0f87fb62e3445589cb7047d262f5e0fba408f484b2d7dcd73802f1a629903c1a4830693203a60e63a121babb08de4a3fcc07d09f0d763049224a2400f4cbe710296e017e39cec7710f281e06ccaac2bc9c4330317595950d8a0bb1e2e1994d270ff985c2814dc08c0c6bc1935627e253effd3a9cd711b662c9156cefbbc225baec63fadfd7b4f1655c703a2ab8364f8616708135e6879b3ed59b2a740f699f4f421bdbdca7ce17a06db4933c80c2af98d085706dc5cee51e1ad6c52fcea930691c3a7d91ef818305d53dd80aaba992a922eb0e0dbd74f69bafea536718bf001310613a310a144b12d54f5a22ec3912bf11a7394ea4986108f64495ef82cc7cd53893c784a6bb7f9cdf896c891b0d5a9823a688f9419478932e36758915095459c5fd5c2528da7f2efc8a857e44ee999bb20a4894b8a34e2ae09f7659d0ba36741bec78a5a874b4934e494d1bb6cd4cd951ce6b4295152e293302a518bc427e480fb0f23f2e043b2f6c16b6152234ee00e7add7a9b1cbccf2558e4b2f2f10545bd70076bddbefa7627603dda9b03768ccda3b3b375b750ddb97d40d4db6d23523056814775fd96912cef71bd2d5056558f88b6953c9d4288d5b7345c2176edced34ced635c0cd22c9f72505d27ec8499c0385103af066f02aee3962f42da2dbc1b947dd04c7ab9969c878b18048204faef64342615907f46b742ade1a52042a02b36cef0f5cd899b59d2d243b403a609cf5b1f962ec930bf3dfe37899bdf893588701417cc512bfe5ccaf36c3124c968233393903f79484e1de02d53c889dfa88bb1ff22b9be2a3fa9bc4b0824ef1c53d8b40d029da7da38733ca9793e3251a5c614c304e86ea9ef99a7ad4080e9d3d23500434a4170adb74315dbce0a55f4f363051dfdb50c02f6d140f4a540d7a502063a89f84340b38caad9a04d1759848923adcba740522e71c04b6dadaf8788ed26735998a0df5e7f41e7fd9fd6b232c75527d4deba0896034f91d069be9fac1cceb6e6aad467730ecde6414c195a4833500fe64e8eee2cc4c9b29641b2b7c29f2313a7cc48c62ea6f05f2ecc1e9e86f91cad220ea2f71a7622008675edd029cfa8723d9b5dd41f7b48b635df2e570a47cd77242e9e36f98e031b8ee234250a1b643950efff0bcae6fd020174e82125fa6e36d6a441843a759313924c2769b5d0c2ff46e97c3fcea993f31b3324ecac6fdd153c476e5591a8310a053b3a13dbe3d02ea4672e3ff7ecd301004ea1262f70320ad295d7e9639d8feb7db01cf3efa014179e5977f9eea100d8a691a0e44ee6b0ddb4d48f8e89f8714fab6bb9fc2729961a61f508a344c1a1eaacf971c76c09e825975c78e4924530bd494fc325a2314222926ffb66c7bb5c2454c35ab3d5698cc612c469ceed9a6efbb0ec5f8fe705e703b35bf5dfbbe6421a8761aed61a02e5a45b2dc9ef675b96621c5c2c74f41681c3325e9be57fe03d565ca7fccb9f0d0c95d599983000aefd99135dbbb2e0da701e7ac3250d49a871993ad1bc61d115afe219ad5aa8a2577e782a05f6ed1c156ea26cec44b0cae1c830f5377c6a19d10781f03ca705db288c7636df36daf67bbaecab5b109f04dfa66893910ab3596453e44660b85a2e54b7c66d31736a8e42a3c5ab121f2037817dad4f4639ecac7b62133a48179229986d4bd0cb70bd3817aacdd0527c69c6fd251ab8d99e0b91ed3e691f4a53b292de695f3b3dd355a9911a2b7fe8cd269bd56b0c8b53a5b81915465020476bfe5da90c50c995ab0fc5db9406ce66052d5b98741f48d845e4190ab3a2bb03be24417c31bfc836f927c340763f3cfc0d185eb9439401e31e6f4c593e56a1fc6721e8bf820dc01b3798e86db3e330b9f11b3ece953ee52cb7f3e630da566d09a151c2035b07eafd997ef1042957be6273895f92b6ad3438a48de638b290a10fe36f26fcf24eb6e307a629c243451d5e10c67123eeb24565264112b3e2ef1b39921a1d07eb254ad7c604decdadb4c4356c83411b56c93b5562a964fc798a79ec9649a5ca950ff966bfefcd6f7aa8fcb677e64bcd8b787f05b82d1d152ce7153ea80e11f8073a45f2fd79ef621bd2d04d7a5b9f65df699dec53f2c5dbabecb157d230b41bc0d8cc984795683d2cd4b998315a9f5e71a2f26a79e9f686a958eb5df49f15ccd81f7af2c46d0dbf151597c3b6f2e5e366deb94a0e5531ab761d9bb5e09f5d8f669ce3c518b0a08e8bc0c69d533eed44e3d6c12acf1cf26523d6b7aa78deb5adca461b44bc9f09cd449db262d96d38142de27989d3a371d6a884857841eae4f604c2f960bd9894680bf4ef4cf5535f64435ef6a3aea6a3365828deb58e11756ecd021ff118071b92d26da23046dbb28e9125f6f739a71a7eafc7622ede1edabf8370df32428ecec39ee666ce9d613b6e0b9a4765d0c9b0c4e17ae593bc531ec833c247b5d0ae98d801d84235ddacedb8509adb40a646ee4356524388a798a0573c4cab1146e24579a1470ed07809c231c9002ef684e400ca40671cc13a6af2fc9a527e7327b1f1914489ab57c7bb9c4ae790f918fe664a4c18346ffb7649c14f42a21c8c9fa7f64bc6e5f668ec7c74b89be1e0897d31c5e6deac18329bb0d7e995ad6c6c2a84f8867bf24cbcc7d47729cd132e5128d599cd700f9160872ae969d3f61962b196e3f815e5808290a094288a06b607cff9f1c2ceadf1567eee12d162036a2e3c9704672998d2cfc0cce00a9da23ec7f50e47f5f93f67539208ef0d968c2380662aab43d65e29d5a83da1915cc7b973b038b781544fe65a2dc45e3dbcb27d5f0c0a9c041a0ec8f66a2d76fd8a79376e06f3628bb71d11d44ffaa4c8dd9b62915585048bf81a87b00be8b40", 0x1000}, {&(0x7f00000000c0)="7920dbabbdecef", 0x7}, {&(0x7f0000002180)="3951a1dc45741b266dee642538b733d1d84a786288e751958369044d72e8859b85365d9a393752d83e692edd8562ee881da5715bfa0a8d08e608f65839238783dd89990983591588a381ee57ef2bb8844499d3b1f499c8817e656110b91ef6740315bdda14f394805f2be3684bee307c348536d0e40488d3017b7f3325a05a1ab6121fe2ffab56dcbdec860787d93954b44855c22f6a8233e394b3efc384dd1335bae767aba50b8e6eb570edb8c83aba230b", 0xb2}, {&(0x7f0000002240)="d0ce00005f733e80153d85bd67bb09d23b6545628771c54a0c386439cebad7d28918ca3562bf5bf30e42ce8c45717df9c340f9a6a5f75228634e9695d58b0028945fed482ac487003b4435a3965cee6a83787efa9e48c798f7da56ad9c0f6558bcff1892837a8a71744f658d0d9d7b65e5c40bcdf38d5391cd906ca8f95f04381f42e407e3a3d71212eb862712972f76cebed53f1d552d4ef34d94758b5d25bc2613", 0xa2}, {&(0x7f0000002300)="f1f1c2fafb", 0x5}], 0x6, 0x0) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000040)={0x800, 0x0, 0x1, r2}) write$fuse(r2, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35200000002c0f74"], 0x58) [ 3465.716018] nla_parse: 3 callbacks suppressed [ 3465.720691] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3465.729231] tc_dump_action: action bad kind [ 3465.734802] binder: 14518:14521 got transaction with invalid offsets ptr 04:59:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000]}) 04:59:32 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x36}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3465.768084] CUSE: DEVNAME unspecified [ 3465.772197] binder: 14518:14521 transaction failed 29201/-14, size 0-9 line 2995 [ 3465.791463] CUSE: DEVNAME unspecified 04:59:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000074000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:32 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000001300)={0xffffffffffffffff}) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000001340)=@req3={0x100, 0x6, 0x0, 0x4b, 0xfff, 0xfa, 0x3}, 0x1c) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x202, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f00000000c0)={r3, &(0x7f0000001180)=""/193}) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000001280)={{0x401, 0x3}, {0x8, 0x2}, 0x800}) 04:59:32 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:32 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x700000000000000}, 0x0) [ 3465.860064] binder: undelivered TRANSACTION_ERROR: 29201 04:59:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000]}) 04:59:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3465.955933] binder: 14553:14557 got transaction with invalid offsets ptr [ 3465.969332] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3465.977971] tc_dump_action: action bad kind [ 3465.979211] binder: 14553:14557 transaction failed 29201/-14, size 0-9 line 2995 [ 3466.026824] CUSE: DEVNAME unspecified 04:59:32 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:32 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000000a000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:32 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00]}) [ 3466.072353] CUSE: DEVNAME unspecified [ 3466.090982] binder: undelivered TRANSACTION_ERROR: 29201 04:59:32 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x400300}, 0x0) 04:59:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000400", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3466.169279] binder: 14577:14579 got transaction with invalid offsets ptr [ 3466.204725] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3466.213375] tc_dump_action: action bad kind [ 3466.221900] binder: 14577:14579 transaction failed 29201/-14, size 0-9 line 2995 [ 3466.268759] xt_check_match: 3 callbacks suppressed [ 3466.268772] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3466.274591] binder: undelivered TRANSACTION_ERROR: 29201 04:59:33 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2a00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}) 04:59:33 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000002a2e000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:33 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:33 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x68000000}, 0x0) 04:59:33 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000007fffffff00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:33 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/cuse\x00', 0x10000000082, 0x0) pread64(r1, &(0x7f0000001200)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f589ce638ac3c48ea5a791930b0c702d8a91dd32e7941c4e62c2613627f4b0a5c35b482b6ed2c0f7487f7440bcef61af101fc21264f8c6e3c3da027d3fe1937087f50f41636a1d43fae3cd9bb50785548338827ed8343234bb3143c"], 0x58) clock_gettime(0x0, &(0x7f0000001100)={0x0, 0x0}) utimes(&(0x7f00000000c0)='./file0\x00', &(0x7f0000001140)={{}, {r2, r3/1000+10000}}) [ 3466.636502] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3466.645156] tc_dump_action: action bad kind [ 3466.653248] binder: 14605:14612 got transaction with invalid offsets ptr [ 3466.675480] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:33 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x23}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}) 04:59:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:33 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) [ 3466.692263] CUSE: DEVNAME unspecified [ 3466.702262] binder: 14605:14612 transaction failed 29201/-14, size 0-9 line 2995 [ 3466.731299] CUSE: DEVNAME unspecified [ 3466.798926] binder: undelivered TRANSACTION_ERROR: 29201 [ 3466.828908] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3466.837572] tc_dump_action: action bad kind [ 3466.875301] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:34 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:34 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000048000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:34 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) accept$packet(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000040)=0x14) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000011c0)={{{@in6=@dev={0xfe, 0x80, [], 0x12}, @in=@local={0xac, 0x14, 0x14, 0xaa}, 0x4e20, 0xe76, 0x4e21, 0x2, 0xa, 0x20, 0x20, 0x7f, r2, r3}, {0x800, 0x21, 0x2, 0x8d, 0x2, 0x9, 0xd79, 0x1}, {0x9, 0xfffffffffffffffe, 0x5, 0x2}, 0x9, 0x6e6bb9, 0x1, 0x0, 0x2, 0x3}, {{@in=@multicast2=0xe0000002, 0x4d3, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x12}, 0x3504, 0x3, 0x1, 0x1ff}}, 0xe8) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) 04:59:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xf000}, 0x0) 04:59:34 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:34 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3467.532970] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3467.541749] tc_dump_action: action bad kind [ 3467.550166] binder: 14654:14658 got transaction with invalid offsets ptr [ 3467.563162] CUSE: DEVNAME unspecified 04:59:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000]}) 04:59:34 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2b00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:34 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3467.579112] binder: 14654:14658 transaction failed 29201/-14, size 0-9 line 2995 [ 3467.594797] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xb849}, 0x0) 04:59:34 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x4a, "17bdd5134b753396f59a23d26d491488d053979de686394a9fe349e567503401704169ea051ac3da2a92346186e248819beda33b70ffae712086375ea25de3eeadb38dcaa0539de32ed3"}, &(0x7f0000000080)=0x52) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000000c0)={r2, 0x9, 0x0, 0x20, 0x7, 0x80000001}, 0x14) 04:59:34 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000005000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3467.713470] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3467.722186] tc_dump_action: action bad kind [ 3467.722366] binder: undelivered TRANSACTION_ERROR: 29201 [ 3467.774677] CUSE: DEVNAME unspecified [ 3467.782959] binder: 14688:14689 got transaction with invalid offsets ptr [ 3467.793719] binder: 14688:14689 transaction failed 29201/-14, size 0-9 line 2995 [ 3467.805646] CUSE: DEVNAME unspecified [ 3467.851815] binder: undelivered TRANSACTION_ERROR: 29201 04:59:35 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000007fffffe00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:35 executing program 2: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000000c0)={0x7ff, 0x551, 0x5, 0xf94, 0x3, 0x7, 0x2, 0x0, 0x0}, &(0x7f00000011c0)=0x20) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000001200)={r1}, 0x8) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r3, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r3, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 04:59:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) 04:59:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x6}, 0x0) 04:59:35 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000006c000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1e00000000000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x40000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3468.434015] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3468.442695] tc_dump_action: action bad kind [ 3468.455539] binder: 14708:14713 got transaction with invalid offsets ptr [ 3468.462971] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000b00200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400]}) [ 3468.505130] binder: 14708:14713 transaction failed 29201/-14, size 0-9 line 2995 [ 3468.536571] CUSE: DEVNAME unspecified 04:59:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa}, 0x0) 04:59:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x31000000}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:35 executing program 2: r0 = socket$inet6(0xa, 0x800, 0x400000040000) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e20}, 0x6e) 04:59:35 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000007a000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3468.644845] binder: undelivered TRANSACTION_ERROR: 29201 [ 3468.673232] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3468.687308] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3468.696719] tc_dump_action: action bad kind [ 3468.737408] binder: 14745:14748 got transaction with invalid offsets ptr [ 3468.781949] binder: 14745:14748 transaction failed 29201/-14, size 0-9 line 2995 [ 3468.794137] CUSE: DEVNAME unspecified [ 3468.838543] binder: undelivered TRANSACTION_ERROR: 29201 04:59:35 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x600000000000000}, 0x0) 04:59:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2d}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 04:59:35 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000003000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:35 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8921, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="f9bf000000000000"]}) close(r2) close(r1) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x111480) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000040)={0x0, @remote, @rand_addr}, &(0x7f0000000080)=0xc) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r5, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r5, &(0x7f0000001240)=ANY=[@ANYBLOB="580000000000000007000000f64cf916f59673628b914aad0412cf3ee8b53ccfbc17f25d9f01000000e079489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed43951fbaf6dd7c076f64220e47ce4f32153373b8809236580266c97b9f870db1858837b2bfee78498696e99753ea5a378fa8384d3243ad0085d98722c89472693a0c7502991220acfc74a0207c826ab3cf76dc2ff1abe97a8d759c0f12b64af806cdfcf89023839e18713d6a1273ed77012b366d3c51db354393daf00b934d4c9ec3f5a88182fb0c8413997ec4da711583419714b5fc697853d73542c92ef08f06935b310034c51b5e6036fe6071632a5b8162c16c7aab3a44cf18546431bd5133050000000000000000"], 0x58) getsockopt$packet_int(r4, 0x107, 0x11, &(0x7f00000000c0), &(0x7f0000001100)=0x4) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r5, 0x111, 0x2, 0x0, 0x4) setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f0000001140)={0x5, 0x6, 0x6d907929, 0x6}, 0x8) [ 3469.319483] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3469.328092] tc_dump_action: action bad kind [ 3469.343934] binder: 14761:14766 got transaction with invalid offsets ptr 04:59:36 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x2b}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}) [ 3469.366162] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3469.370466] binder: 14761:14766 transaction failed 29201/-14, size 0-9 line 2995 04:59:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 04:59:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000200000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3469.461650] binder: undelivered TRANSACTION_ERROR: 29201 04:59:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:36 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}, 0x1b00}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3469.507952] binder: 14794:14795 got transaction with invalid offsets ptr [ 3469.520337] tc_dump_action: action bad kind [ 3469.526110] binder: 14794:14795 transaction failed 29201/-14, size 0-9 line 2995 [ 3469.584529] binder: undelivered TRANSACTION_ERROR: 29201 [ 3469.625011] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3469.638286] tc_dump_action: action bad kind 04:59:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}) 04:59:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000000ffffffff00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:36 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:36 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}]}) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf9163383e21f052ad70d0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c7796689a7c0dd3c23b2f8e3ceefcfddb6ed2c0f74"], 0x58) 04:59:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000e0a202000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3470.231349] tc_dump_action: action bad kind [ 3470.248414] binder: 14830:14836 got transaction with invalid offsets ptr [ 3470.271292] binder: 14830:14836 transaction failed 29201/-14, size 0-9 line 2995 04:59:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000]}) 04:59:37 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3470.279253] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3470.282399] CUSE: DEVNAME unspecified 04:59:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x14, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000002a50000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000000020c4900", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3470.341681] binder: undelivered TRANSACTION_ERROR: 29201 [ 3470.418125] tc_dump_action: action bad kind 04:59:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00]}) 04:59:37 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x11) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r0, &(0x7f00000011c0)=""/4096, 0x1000, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000040)) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3470.454814] binder: 14859:14861 got transaction with invalid offsets ptr [ 3470.471319] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3470.494289] binder: 14859:14861 transaction failed 29201/-14, size 0-9 line 2995 [ 3470.567670] tc_dump_action: action bad kind [ 3470.589074] binder: undelivered TRANSACTION_ERROR: 29201 04:59:37 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:37 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0xe1, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000a0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800]}) 04:59:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:37 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="5800000000000000010000002000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17abe09f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cf1194b0a7c35b482b6ed2c0f74"], 0x58) [ 3471.141141] nla_parse: 5 callbacks suppressed [ 3471.141151] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3471.154327] tc_dump_action: action bad kind [ 3471.159351] binder: 14889:14892 got transaction with invalid offsets ptr 04:59:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}) 04:59:37 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3471.189887] binder: 14889:14892 transaction failed 29201/-14, size 0-9 line 2995 04:59:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000400", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000004000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3471.251187] binder: undelivered TRANSACTION_ERROR: 29201 04:59:37 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f00000011c0)=""/4096, 0xfffffffffffffe7a, 0xfffffffffffffffd) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) write$binfmt_misc(r0, &(0x7f0000000000)={'syz1', "b85f51b7664122488abc266bbb179c0b0833ec9643943bee81ee9765d4bd314e543a9f51ad444575cc331bed654bf80d9cd03161927f35c8e74476d7fe9f1691bbc34af22ccdbe688d731cc0927755cde93b5b9de0c6cc29add2dad787959b832116d1c1b7d674b67b6adf1a137c98f2044dde471b25ddc36aca50a00ed2e2badd0716c2843ad97906370265a12fa93be5716171b16bc6630392347b530deedab01d6c93c3d0a06f338211bf05c50bf5ac4ebbdc4358699e61016397fa0aaf2127d3d9523cbf9b5ad75324797629e201e4bdf6af981748459db528afb6a7f3f43f448f022ffcfc382b682c17d6ad6556d8bf972dc2"}, 0xf9) 04:59:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0xec0, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3471.327709] binder: 14917:14921 got transaction with invalid offsets ptr [ 3471.362372] xt_check_match: 1 callbacks suppressed [ 3471.362384] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3471.382437] binder: 14917:14921 transaction failed 29201/-14, size 0-9 line 2995 [ 3471.466289] binder: undelivered TRANSACTION_ERROR: 29201 04:59:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000]}) 04:59:38 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:38 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:38 executing program 2: r0 = socket$inet6(0xa, 0x7fc, 0x1) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) 04:59:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000068000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:38 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0xf, 0x27, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3472.067703] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3472.076374] tc_dump_action: action bad kind [ 3472.081284] binder: 14950:14956 got transaction with invalid offsets ptr [ 3472.096446] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:38 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 04:59:38 executing program 2: r0 = socket$inet6(0xa, 0xa, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x20000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r0, r1, 0xe, 0x1}, 0x10) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001240)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f742eae5394e974c5664b8d83d9c9ec958d28c32df69454a62d1acee179a7a5408168aefee19e97cd9af7d391c0d13013dee30c2487a7789a5b29e99c19a7d4992cd5924cea434c532f2dcba763e5947c1dfd20b95e6c3de5031623ccc362373f63dee16b8b1e19584376394b31b6584666a9ae1cd476135b1ef3b7539abbc01cb0e10c20da0b226c9fbb31562f7dcdad7b8c472468c68bb0ddaba7abc922ac79f10a708eb2ec506119f486bf0695afc7b831e8b0ceecc37f2696fde29ffdaf5f6d631bf854051d0031999ec401eaeb7b8b76e9798e887c777f09685bde1b61b27ce673893c04df"], 0x58) [ 3472.113369] binder: 14950:14956 transaction failed 29201/-14, size 0-9 line 2995 04:59:38 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0xf, 0xffffffffffffffff, 0x0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:38 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000002000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}) [ 3472.262298] binder: undelivered TRANSACTION_ERROR: 29201 [ 3472.262947] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3472.276449] tc_dump_action: action bad kind [ 3472.325487] binder: 14986:14987 got transaction with invalid offsets ptr [ 3472.337227] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3472.348310] CUSE: DEVNAME unspecified 04:59:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:39 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}) [ 3472.384162] binder: 14986:14987 transaction failed 29201/-14, size 0-9 line 2995 04:59:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x34000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3472.503494] binder: undelivered TRANSACTION_ERROR: 29201 [ 3472.524771] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3472.570276] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3472.579045] tc_dump_action: action bad kind 04:59:39 executing program 2: r0 = socket$inet6(0xa, 0x4, 0x20400000003) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000000)={0x0, 0xfc00000000000000}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000080)={r2, 0x200}, 0x8) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001200)=ANY=[@ANYBLOB="ff0f000000000000010000000000000007000000f64cf916f544eb22c9d915fd86cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a79069298bc2e1b564ed32e796689a7c0dd3cd0191c05cd48d1825c492c0f740000000000000000000000000000"], 0x58) accept4$inet6(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, @loopback}, &(0x7f00000011c0)=0x1c, 0x800) 04:59:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x100000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:39 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}) 04:59:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:39 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:39 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000012000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3472.965402] binder: 15037:15039 got transaction with invalid offsets ptr [ 3472.967195] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3472.981056] tc_dump_action: action bad kind 04:59:39 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3473.007274] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3473.014408] binder: 15037:15039 transaction failed 29201/-14, size 0-9 line 2995 [ 3473.094747] binder: undelivered TRANSACTION_ERROR: 29201 04:59:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 04:59:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x2954000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:40 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000074000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:40 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:40 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x8100, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:40 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:40 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3473.863839] binder: 15076:15078 got transaction with invalid offsets ptr [ 3473.866822] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3473.879397] tc_dump_action: action bad kind 04:59:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}) 04:59:40 executing program 2: r0 = socket$inet6(0xa, 0x80000, 0xfffffffffffffffd) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x50000, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91def2e796689a7c0dd3cd019120a7c35b482b6ed2c0f74"], 0x58) 04:59:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:40 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3473.904471] binder: 15076:15078 transaction failed 29201/-14, size 0-9 line 2995 [ 3473.923588] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf0ffffff, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:40 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000004c000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:40 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3474.032716] binder: undelivered TRANSACTION_ERROR: 29201 04:59:40 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) fallocate(r1, 0x12, 0x7fffffff, 0x80000001) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) [ 3474.091713] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3474.127536] binder: 15113:15114 got transaction with invalid offsets ptr [ 3474.135639] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3474.144322] tc_dump_action: action bad kind [ 3474.148494] binder: 15113:15114 transaction failed 29201/-14, size 0-9 line 2995 [ 3474.234871] CUSE: DEVNAME unspecified [ 3474.278348] binder: undelivered TRANSACTION_ERROR: 29201 04:59:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:41 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x2, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:41 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00000000000000]}) 04:59:41 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:41 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000fffffdfd000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:41 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x1) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d87f2fe1ac796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) [ 3474.795125] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3474.803739] tc_dump_action: action bad kind [ 3474.815419] binder: 15134:15145 got transaction with invalid offsets ptr [ 3474.825824] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:41 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) 04:59:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3474.862556] binder: 15134:15145 transaction failed 29201/-14, size 0-9 line 2995 [ 3474.867303] CUSE: DEVNAME unspecified 04:59:41 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xfffffffffffff000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3474.945588] CUSE: DEVNAME unspecified 04:59:41 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000001000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:41 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000]}) [ 3474.982156] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3474.990863] tc_dump_action: action bad kind [ 3474.997782] binder: undelivered TRANSACTION_ERROR: 29201 04:59:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:41 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0xf5f7, &(0x7f0000000000)="29a3a6a36db568e1311f14") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000000c0)={r2, 0x35, "4b349d6108c2ec6767a25d8acdf08304aed5e524aa1e845c22e856e589e4e00862b11583b59e1ff6443579d12edda05f86e5dfbab3"}, &(0x7f00000011c0)=0x3d) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000001200)={r2, @in={{0x2, 0x4e20, @multicast1=0xe0000001}}, 0xfff, 0xfffffffffffffffa, 0x5, 0x2, 0xffffffffffff432d}, &(0x7f00000012c0)=0x98) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3475.026293] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3475.054209] binder: 15180:15181 got transaction with invalid offsets ptr 04:59:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc00e000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3475.110089] binder: 15180:15181 transaction failed 29201/-14, size 0-9 line 2995 [ 3475.142376] CUSE: DEVNAME unspecified [ 3475.202166] binder: undelivered TRANSACTION_ERROR: 29201 [ 3475.210943] CUSE: DEVNAME unspecified 04:59:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:42 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) 04:59:42 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4, &(0x7f0000000000)="1ffb3a5b5f37c0011499e6ee3b0ce86815526951be3fb9eb1f96bd7e10124b20378b59a97d8bd118a9f9eee2fe2e8c7dff81a813382250b9e89351f93ba00fb895e8879d4dbe87cf1e399b5717bc317e96ba38f0cfecced157c0add3bd0266b9761204080d0fc39ce7ddbc8eedd44566f0e6641d591bf4298244f021371c4f9d19e929e3e07a1fc9fc15895d565947ffabf2a692715727f57c58893a0b36957b3362c4530b9f683d185202") ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f00000011c0)=""/4096, 0x1000, 0x0) pread64(r1, &(0x7f00000000c0)=""/52, 0x34, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x2, @loopback=0x7f000001}, @in={0x2, 0x4e24, @multicast2=0xe0000002}, @in6={0xa, 0x4e24, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x8}, @in={0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e24, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x400000000000000}, @in6={0xa, 0x4e23, 0xff}, @in={0x2, 0x4e22, @multicast2=0xe0000002}, @in={0x2, 0x4e20, @multicast1=0xe0000001}], 0xa4) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f07000000000000005a791930b0c702d8a91dd32e796689a7c0dd3cd01908000000000000002c0f74"], 0x58) 04:59:42 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:42 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000120000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:42 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xfffff000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3475.689535] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3475.698162] tc_dump_action: action bad kind [ 3475.709553] binder: 15217:15219 got transaction with invalid offsets ptr 04:59:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}) 04:59:42 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:42 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000004c0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc00e0000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3475.731944] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3475.740597] binder: 15217:15219 transaction failed 29201/-14, size 0-9 line 2995 [ 3475.776411] binder: undelivered TRANSACTION_ERROR: 29201 04:59:42 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3475.875093] binder: 15239:15241 got transaction with invalid offsets ptr [ 3475.894588] tc_dump_action: action bad kind [ 3475.911219] binder: 15239:15241 transaction failed 29201/-14, size 0-9 line 2995 [ 3475.994374] binder: undelivered TRANSACTION_ERROR: 29201 [ 3476.523912] CUSE: DEVNAME unspecified 04:59:43 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:43 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) fcntl$getflags(r0, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:43 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xfffffff0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000a000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00]}) 04:59:43 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) [ 3476.609298] nla_parse: 1 callbacks suppressed [ 3476.609308] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3476.622472] tc_dump_action: action bad kind [ 3476.633809] binder: 15266:15267 got transaction with invalid offsets ptr [ 3476.645735] xt_check_match: 1 callbacks suppressed [ 3476.645749] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000]}) 04:59:43 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:43 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3476.655400] binder: 15266:15267 transaction failed 29201/-14, size 0-9 line 2995 [ 3476.683922] CUSE: DEVNAME unspecified 04:59:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc500000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000007000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3476.747141] binder: undelivered TRANSACTION_ERROR: 29201 [ 3476.786664] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. 04:59:43 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}) 04:59:43 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003500)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f00000011c0)=""/4096, &(0x7f00000000c0)=0x1000) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = fanotify_init(0x0, 0x40800) fcntl$addseals(r1, 0x409, 0x2) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x201, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) readahead(r1, 0x8002, 0x4) getsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0x8, &(0x7f0000000040)=0x4) sendmsg$rds(r0, &(0x7f0000003400)={&(0x7f0000002240)={0x2, 0x4e23, @rand_addr=0x2}, 0x10, &(0x7f0000002340)=[{&(0x7f0000002280)=""/23, 0x17}, {&(0x7f00000022c0)=""/128, 0x80}], 0x2, &(0x7f00000033c0)=ANY=[@ANYBLOB="30000000000000001401000003000000", @ANYPTR=&(0x7f0000003640)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea6a2e33e80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084d583854c03569864a1eba531edf839887a50b833f93e79129ad88aa107a52be969b0b15ddec2f2220abb5cc5e8137be3cc5184f8b201f12b076e4051285bf2198fa77e80cab4f8fccb91a8e693fdab4f8773502210410e6ff59140c14b08e9f58ececcfd9a01c340b565d6918e444789fcdf526c3696cad7adcdc1e9752c957ec0385e24818ebf0906326a86acebcb16236f2b4dfe1146392f0e2a6ebc23b9978a495693bd1b0139575104ef528bb23684d1f479c844"], @ANYBLOB="fe01000000000000", @ANYPTR=&(0x7f0000003540)=ANY=[@ANYBLOB="e6be367ae7cbde1ed832bd949a8f502344aabc2306aa035689b7cd9d8dc471cc57ea80c9409faae3f6e85360e2de66f75ee09c3f9e5592eb609c95a7cbc74cb06c31f308d9f6a97d0263761263b94f3ae9c4caf934a819589956ca5131b62803f08b811b57dc0fbe67630defafe5c8ade79765b931533262d4d15005289be75cb2784f6c0dc79b30e4da98a305fb911e94f619d5c220254dc3d1f77c6328bb33c7142a2ce6f977c51ebeacf2e1a7d05a1eda72916a2798b241416ba1cfcdeb94a4b31bba399b7a"], @ANYBLOB='`\x00\x00\x00\x00\x00\x00\x00'], 0x30, 0x8000}, 0x8000) symlink(&(0x7f00000021c0)='./file0\x00', &(0x7f0000002200)='./file0\x00') write$fuse(r2, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596730600914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b4e182b6ed2c0f"], 0x58) 04:59:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000300", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3476.796007] tc_dump_action: action bad kind 04:59:43 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3476.861921] binder: 15299:15305 got transaction with invalid offsets ptr [ 3476.898113] binder: 15299:15305 transaction failed 29201/-14, size 0-9 line 2995 [ 3476.928983] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3476.992748] binder: undelivered TRANSACTION_ERROR: 29201 04:59:44 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}) 04:59:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc5000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:44 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000012000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:44 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:44 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x100000000008, &(0x7f0000000000)="295ee1311f16f477671070f06e84984e65dacf18") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000080)={{0x1, 0x7, 0x5, 0x8, 0x6, 0x8cf}, 0xa4, 0xfff, 0x9, 0x80000001, 0x40, "d4b800e5201501f2c3daa71b0c63955fe088bf26a8af7c8045f508adcb01533205fefd43994cc1951f32c61f6f7599ab1c723381d550f526b4d3ee03ad028956c2bf4d97743b9233b5cd16154800d7090778761369e810d17d0bcb6755c1c4bed08811e2a6dc0e86df7b5b62c5fdaf40084cb909cf7ebb89923ac9ba4cc05a50"}) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f00000021c0)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3477.520680] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3477.529461] tc_dump_action: action bad kind [ 3477.532572] CUSE: DEVNAME unspecified [ 3477.537445] binder: 15334:15336 got transaction with invalid offsets ptr [ 3477.555779] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3477.564314] CUSE: DEVNAME unspecified 04:59:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}) 04:59:44 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000001100)) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008916, &(0x7f00000013c0)="295ee1311f16f477671049") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2007fd, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000001400)={0x0, @in6={{0xa, 0x4e20, 0x7ff, @mcast2={0xff, 0x2, [], 0x1}, 0x9}}}, &(0x7f0000000080)=0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000014c0)={r3, @in6={{0xa, 0x4e22, 0x2, @local={0xfe, 0x80, [], 0xaa}, 0x7fff}}, 0x6, 0x1, 0x3, 0x4, 0xffffffffffffeeab}, &(0x7f0000001580)=0x98) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={0x0, 0x101}, &(0x7f0000001240)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000001280)={r4, @in={{0x2, 0x4e24, @multicast2=0xe0000002}}, [0x100, 0x7ff, 0x4, 0x800, 0x0, 0xfffffffffffff8fb, 0x13d, 0x80, 0xd27, 0x4, 0x100000001, 0xffff, 0xbb3, 0x58, 0x20]}, &(0x7f0000001380)=0x100) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) [ 3477.577748] binder: 15334:15336 transaction failed 29201/-14, size 0-9 line 2995 04:59:44 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:44 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000501000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3477.702957] binder: undelivered TRANSACTION_ERROR: 29201 04:59:44 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}) [ 3477.749590] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3477.758236] tc_dump_action: action bad kind [ 3477.800836] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3477.809979] binder: 15373:15375 got transaction with invalid offsets ptr [ 3477.832963] binder: 15373:15375 transaction failed 29201/-14, size 0-9 line 2995 [ 3477.898494] binder: undelivered TRANSACTION_ERROR: 29201 04:59:45 executing program 2: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40000, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0xffea) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x5, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x43f) 04:59:45 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000730000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}) 04:59:45 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:45 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc00e, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3478.374469] binder: 15398:15403 got transaction with invalid offsets ptr [ 3478.387504] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3478.396133] tc_dump_action: action bad kind [ 3478.405861] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3478.417211] binder: 15398:15403 transaction failed 29201/-14, size 0-9 line 2995 04:59:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}) 04:59:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xec0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:45 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:45 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000480000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3478.528070] binder: undelivered TRANSACTION_ERROR: 29201 [ 3478.560248] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3478.637312] binder: 15432:15433 got transaction with invalid offsets ptr [ 3478.658078] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3478.666712] tc_dump_action: action bad kind [ 3478.677805] binder: 15432:15433 transaction failed 29201/-14, size 0-9 line 2995 [ 3478.718227] binder: undelivered TRANSACTION_ERROR: 29201 04:59:45 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}) 04:59:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x40030000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:45 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x20202, 0x0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:45 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:45 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000004000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:45 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800]}) [ 3479.292695] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3479.301375] tc_dump_action: action bad kind [ 3479.306962] binder: 15457:15463 got transaction with invalid offsets ptr [ 3479.312878] CUSE: DEVNAME unspecified [ 3479.324641] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3479.331493] binder: 15457:15463 transaction failed 29201/-14, size 0-9 line 2995 04:59:46 executing program 2: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2000, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f00000011c0)=ANY=[@ANYBLOB="00100000279caf4850d450d3f666a6f6e4f35e465dcff458990b6a07a84f9437c2f3095227622a7d261df121921499d7d725542fd8e9d3fd229253357bbd8c55e8e060ca3d17bc754d62c065ccc41cbcdc72c823f4ef50333eb634a20f142142f698f9ee4f32abd2a07ff5346a34616718223885bff064c4e86324a0fe92685a72d63f0e688cfb9b470b64c3ea88d5c3a1035a018b9b27772986ca560d3ab642923119dea338411e48c797189b465cdfa1730774b93135d4fbe5a1fc914cc94cb2db370e2d3148f4e12e1861bf2eb6997bbac456e2ec55adf7dc768ff1a74a10a96c83c2b0f54811b876e8b6e0b69b44f66e3a71774d48dc007ae73a30278e5a71295c4af5690063bd488a1bed9c681b82f1ebcbf974853ef64100662f1bcd57961fc410486c326b08a5561ea0506df3b46185b8ecdddb18de376bd38b0b93175ad6a9897c4868e3943eb641fdb607a886b9003342ab2652b48993d64307f4d37732a4c35f4ca33c88446bc15d9ebc07e8b35f7b900c321f144591c4d83a5dbbbaf3c81d5bbecf5dcb5b49c1fb8d5bd844a3693a59a959880ab7b1740cb8619a893ba28791724369713a6229a9391b053ba9774411ffc5582a6b604d6f37f72956637428506c36f21c8d5d54e9905cda8e1203bbbe0e6f83daea8f0efcba166d3321f583120fd2c2026fea6574fc5c9423d642edf6c94ce1782761495c6d063a11b7eab4e915feeefa1e3891b05c35da971acbe3151e4408ddd512c16d77231da6ed9c6a7c971a290f80d55133da6d217ecb5a44fd7279a629e7b3a93622e66a0b98a01c930602849a46e2dc3893720a677392a507fe3c4d112eb9a52306976036815328cff1f47626045d893de9fed8c6d679019254a43c47f34c1410f1d57efaf10686ddbb89593d066623d9721135e10f22a0062ebcf1ef1f90c57f87e343b8a46ea751151fa6ebca1c7e3829753e0c515e9776e2a6821fa5dd713ecb7b129e3497c677bdd165d7209fcb81d09f0f4b8ee83319b5301f56402d5ce651eacfb1ce216b48baa9b78e3fad7a96d19930718e22811f3987fc48ccc6f89f2a3fefc53cb5e62538e895a81040fd8fb84da7ad192ba4e51eeaf9d49b1bcadd79a8e8b6cf28f8155e132636f637d1f024109ed76b447f56d2451205860fc6f97dea178d028e0b394583311d129d945fd266ddd9460a1869dbe203fe82811304c7ede434c3bd880f0861f9969c4aa7418c221a51214c4c9d5430eab8276b8ca40a4195f88ae6c16dc5bface19d12ec647ee589e080aaf264b9d36890a9d9f12e6c896b0b8a999fe96f125130a5608e7b86306afdb9d7b1527868d3307ea160852cfced71b015bee3191e2ec78b663a10fad263c6feaf27d3aadde6ab69e47805df8c5a0313ab43f2e812fc7a9f0228ea422a2e731b097a15a242b46e3fb4ba33f86b07f31315b4f362a3f837aaf67031ba307a983c81c7e5eb901300095daf3486e2a30b22417c101c11068731f0045a3a5437faba8be70784e1ee10c505338b069144c0ccee568e29944782efeb84c355110eeed0f085d48627fc597e5bf901660c7894c4faf32d67cadd223613316f39a285fe00a7d3a753103fcfa85db71e65a9c907ee8bc9e4b87d3f6b8d789e66122bc06052cfe433e76ce9939547490e4be8f122809c3df8673d6eae73851285a177f0de9e30a09d26bc247fea4b849513e766eb50e2a7a346ee8ed88d08de498305c3c3eab1a8128755662213a0772ce579cd55cc848de25d031aed118cbeeb17156e6926b4b272aeda021b0b6581b0ce85e3d3e1c25b8f34482d7f8abdece3a836775952aa8c9799e5c29d141c343baccdceae3003f984b7516833a0d5df80d4962d32f3555b31413b6747b48ed756440906061b25d4a1b13c702ebd409c0509bf02d2e34e0d901525dd1348e78aaf0244d74aa3b616bebc1bd00c997beab24e0eba91bf68e01218619e793d01f0aa1821595527f8bc32ba79463507794ddb2f0380344b6de29c29ca82c67a54721c512ab9c2ef5e092ab61989fb3129a71b7528c2382c980619db6a3cf02f868ada7385acb49c263fa8fe1f52c0c9918d10b72d3888389d7ffcd330a6b54319ace98b18fd4ea9ab1f6dd133370434ff04f5126f594effbfe946b6c594c3c703bb2b748220f802c59e2284ff0aa87b99e108e038829dab9214d3f80878ac20eb4319e095a7286e118da5b6c8ac4e034f2c2f0e0f93cc5e58d6a3619efcd11818dbbe0c2e9941de374743443eb50749dd781981737d210f953a76e465aaafe27873947010b215e8984270330d5c870ab81845e07cdd14cc6b9c014ecf1cd96949b07194f119dcd33b78fc241ee8d069425b2bff501b13e00e004113a9890c3b3b05546d74c44d23a2fc0b30714c72b1ff17c72e5f1889b275328f51b37208562b2b0d28edbc863320c66ee3b88c730461f6c37cf884ac5c70cd92b83eeffa1d81aff2b98135271402813779129c332ee280bf154b79501d8ddf07d9bac6cd4c7e0e50de0491daeb3cb8508424740848da895ca26561be29a362c4dfa87ef5f3ff2ef4ef4724d38052355ac286e006b4fe34c71ea45991da162314fb1debbfee7b7c12a8db646051eb3b33a77c8b0e5dd603f2d37b97c0f691aaf61e4659c16dca8e469f65465fe36b256fbf12e4356dcf5b1bcbe86905c07430dc55f6ab71a43ff3c513af2b0d17c5ef5452b603bcae49c98407c2240d322e6dba378c659d5e40999f3406563739b5afb17e83d7474cd7400e136f46a89b313211310e85945a3cae190c05aabc40c833efab21bf0c8341dd791be27f7bef1432ded08231ca74f50b0fe5d54eaba419a2880cff74f7746b5ddff639b58094f69eab02fcd91688a0ffd1eace0e69ae26b7952063b6f8f6f3998378a03dbe73f15594bbc115a48fd3b4fce24e1afde5684c61e431684886800fe62128cf5d70ff4e098b683c241f61e8bfdf1bf2023df984f548332120bef3708f81022964203b32f1f93c3f531118017875f4739a8594b32ef529efd55a4ed36f7f2202f1f2f83e1d7738be0520b1e83cb17210d8164e1ae6a50145afc1d16e01d5a77c8965ed6951f24e881bd58908d6b3a10402447a72b1f8ed93af7bd65a1a13b22766cc742b94162833babfbf6bb11fc6852f40dda1661f8e968f4d72828f96ea1a7628ddca81bfc8fa295534b2726b34bf52b7681056fdb9529b0ccf200b5f01e92ebaa55bb631960caf3279bfcb53ba86d8239102cf1c4e6f8a169f682d300358c0dee0b60948936b0c232100c171352770de3960394d48341905859631f566fb776eb2fb05a0d42c86ca3672c967574fe35ff237c81c279c6a079f21fd0b596b0f901c005db00f006d9ecc434e9313dc14a0d98cb7166e44882d9a75a4ded6b39c3ee85992d6741ee2d58942c2b6a4f58244285201a4583e7303557806e00a04eaef3a63150390c0332a3ee317dd3a08ce75a12111ce7e5ce6f1d87cdc514b61fa93ee7090f852ae007a091df97f59110bd2f1e3eaa6fb5ea1891bdb379a89cb46a370baf75cca003ace4138953ec1f7313c17311c38c284a9721eb8ba348f41f281242248e36356b0dca56f5511b63822e36a56d93908dd58867388d33b9a62220a56a233dda2e3c9c7c5b97533dbc0988911d0622a089fee4d009b1ca4f0b01684111830bb7f12a90f11947c074312a090103a070414cba1f2281569021dd8e3dafe9d3ac5f53e250b06700bcc19c2193648b221c16607f7613750bcefd0d14f06f66d47782c12d35be29657f3f8d498058a4a3dc43fbda463e56f64ea860165829331de6ae07c5dd4ec155822d20d42e4732fab4925b17f279bcd641a079e2809a8921b4d0dd26efff351f1d0c5e5e78f471d66bae828094f4d789c1b824b0303110f5b2265007f5271588caaab61e294bd575ff8a279c10b3c420d3cba4b5d1fa669246bc1de59337af46b5b3892866cf3d61a367612d28636c08207391d04960ffe6d026dc39d18f224a799c0c9a3ffabbcc2c17331313c49544f5f4d52e8765393902a2531f423007206506443687e956815e90d1a1f792f1cf47df072cc45ebc66b9d10c4fe1bb2f3692389f6fb74dccdba89348055c47434a10e25daa1faed51fbb42c732a1962f9c1f11641af896630ba90ad451759f2138cbdee6f424b008fea11f1c688dbd6aed7bb396a6157ba5c4d06064b83fdf5ea21b18ee29d5ee5d1e0ba49934f4c6be96077f61c3e01955fa9899196000974972fc7846224d0e8daf4dad9cafd93920f2f401005902b5612b3b360d804d4ca783997af95511cf7d35bf0b9d6a300ee5420474488c0fe41b737a3c8a7cf32af5646b6bd332675dd84cf6de5778cdba42f40dc1944eff67afaa468600e4cb8f42abe3065076d13baa2198dc1adff7274de9210577f8f00a770cc53afcfa313dbbaa7969256c58da0de4b7940bdf6c5e9842eaab51355379bc500747b694b71a3852f0486ab0052170fab5c6dfe471a7de9687dcfbd64b2cb4f7b03541bc02bb47e9eb2a22cc6c1a196eb3aa2575528ed6e1acfd08e0053860794ffdd93b8b0f03fb1f4931d445ff5f42242452b578a6e01b63a74a719e610079246c241f4879c28d931494622356fdcd8d59b65f1e2a0cb8a289b1d67ae1a269f33987d2ee302f6f9b5427687235c357c932fbeacf0ea229a0ca4f17ac44ca21c80a139fd3ecd536e27e56d9168915c05457536a6c284a1270b9ca5c36d92433fb795eec7d954414bc3281c470006d51c0968df60bd1181d46a92479b2a6a199bbb0683b93cb5811b4d5bb49e356acbdb8d3109031e084716e02818c3b864bb14c28b12442d866b8c67c7baaa653508c76d3718823e964a1eefcd29abab0edad01e8e9e3a906fcc48b6cfb733b7455b7aa134483ec19ebbcf02f60bab5b29b77ff954c2d08445e2eb0b419cd3ec19f1a5a4c3dbae6aa45a633aea8f92212db07d57c39af0cbbe0f10db1515a206370cbbbfb9ed5a56815e19ef72f9d089652a6c861bb3bee3f62c897898de68683d053890fa20590492dab2331fa3ce4280aa3b83dfb3bba2da0bd428ee424f60962c5d6614f08569282ecb6543236f27c83be596db75401a5ab368ab6ec075ab48861e1882928259e983815bc8b8489d12b9887de26cb42b364a1883ffe36492fdc5095592aa83a891d5c85fd51cb3dfeda16fa434013cb2744efed3144e8da13d3328f93a18eee95cc648a5abb7b1245fda71277c84d17668557b84f73a3d654e286792cc8d10af6f02dd9f355eb7db2812ae2970d85c1a7b46516159bb984b397531c0b74b88b909738da11f97d36eb11a66200e0e4c51f0d35ee9e6ebe1aa31d80dea550ab56db5268cdf9979c86d56b30f0fda7a180fd51f11bc1c38ba721f50640fdd70dbac5211fc59079831ee70d1041523b3d14a4443ce46506403c336a2ed81af363d29a4914549d00829606729731fa709782291026014ac6659de04a11081fbcd58e0e6e4db04c8d56f8fd2e7bab696b076844fe339c4d250dca5d38f4db83c8e5d9e4dd056bd747aa8b1351a46ab8f8fe951fbfffcaecd6784453cf2e7e4dadbc4c0549b5a9b79d7bc20e47cebbee801f2422aa78970c2f3b7b8fa7ce4d907dc41e2f73cbf0dcb9265a87feae46e1585cac5318b4f3954d49421a7039fdf3373f6646191267a791d74fd074e37bcd2fb780e2595da555bc9fc097778889e39904ce29c0ec32c139197f08401f69b89909b243afedc5c96cd310ec9d1544458193cb7caa42208c7c794e42a9f"]) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xffffff7f00000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:46 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000004000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:46 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3479.411186] binder: undelivered TRANSACTION_ERROR: 29201 04:59:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3479.514400] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3479.523066] tc_dump_action: action bad kind [ 3479.528171] binder: 15490:15492 got transaction with invalid offsets ptr [ 3479.537804] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3479.555390] CUSE: DEVNAME unspecified [ 3479.558267] binder: 15490:15492 transaction failed 29201/-14, size 0-9 line 2995 [ 3479.619953] binder: undelivered TRANSACTION_ERROR: 29201 [ 3479.655272] CUSE: DEVNAME unspecified 04:59:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000]}) 04:59:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:46 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:46 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000020000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:46 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:46 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x2) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x9effffff, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3480.174803] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3480.183417] tc_dump_action: action bad kind [ 3480.183911] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3480.200233] binder: 15513:15514 got transaction with invalid offsets ptr 04:59:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:46 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}) [ 3480.218706] binder: 15513:15514 transaction failed 29201/-14, size 0-9 line 2995 04:59:46 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3480.254287] CUSE: DEVNAME unspecified 04:59:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc5, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:47 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000007000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3480.350088] binder: undelivered TRANSACTION_ERROR: 29201 [ 3480.380576] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3480.389226] tc_dump_action: action bad kind [ 3480.392912] CUSE: DEVNAME unspecified 04:59:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3480.412943] binder: 15558:15559 got transaction with invalid offsets ptr [ 3480.443685] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3480.443701] binder: 15558:15559 transaction failed 29201/-14, size 0-9 line 2995 [ 3480.496611] binder: undelivered TRANSACTION_ERROR: 29201 04:59:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) 04:59:47 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000000)=""/176) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:47 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000006000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:47 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:47 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:47 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3481.079769] tc_dump_action: action bad kind [ 3481.093850] binder: 15583:15584 got transaction with invalid offsets ptr 04:59:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3481.131593] CUSE: DEVNAME unspecified [ 3481.135155] binder: 15583:15584 transaction failed 29201/-14, size 0-9 line 2995 04:59:47 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf0ffffffffffff, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:47 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000]}) 04:59:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:47 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040), 0x4) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r0, &(0x7f00000011c0)=""/4096, 0x12ea, 0x1) modify_ldt$write2(0x11, &(0x7f0000000000)={0x400, 0x1000, 0x0, 0x200, 0x100, 0x8, 0xfffffffffffffe01, 0x1, 0x1, 0x3ff}, 0x10) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:47 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:47 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000060000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3481.269729] binder: undelivered TRANSACTION_ERROR: 29201 [ 3481.326862] tc_dump_action: action bad kind [ 3481.335194] binder: 15617:15618 got transaction with invalid offsets ptr 04:59:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}) 04:59:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3481.390207] binder: 15617:15618 transaction failed 29201/-14, size 0-9 line 2995 [ 3481.490870] tc_dump_action: action bad kind [ 3481.502824] binder: undelivered TRANSACTION_ERROR: 29201 04:59:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x1000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:48 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x10000, 0xf4) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000000)={0x8, {{0xa, 0x4e22, 0x1, @remote={0xfe, 0x80, [], 0xbb}, 0x8001}}}, 0x88) 04:59:48 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000010000000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000]}) 04:59:48 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3481.978375] nla_parse: 3 callbacks suppressed [ 3481.978385] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3481.991667] tc_dump_action: action bad kind [ 3482.003874] binder: 15656:15658 got transaction with invalid offsets ptr [ 3482.021099] xt_check_match: 3 callbacks suppressed 04:59:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3482.021115] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3482.031327] binder: 15656:15658 transaction failed 29201/-14, size 0-9 line 2995 04:59:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x2954, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}) 04:59:48 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:48 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000a502000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3482.118680] binder: undelivered TRANSACTION_ERROR: 29201 04:59:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:48 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000]}) [ 3482.216553] binder: 15689:15693 got transaction with invalid offsets ptr [ 3482.234806] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3482.240670] binder: 15689:15693 transaction failed 29201/-14, size 0-9 line 2995 [ 3482.243496] tc_dump_action: action bad kind [ 3482.258293] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x2000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3482.302556] CUSE: DEVNAME unspecified 04:59:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000400000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3482.331757] binder: undelivered TRANSACTION_ERROR: 29201 [ 3482.353580] CUSE: DEVNAME unspecified 04:59:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}) [ 3482.392855] binder: 15714:15716 got transaction with invalid offsets ptr [ 3482.434184] binder: 15714:15716 transaction failed 29201/-14, size 0-9 line 2995 [ 3482.488852] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3482.532439] binder: undelivered TRANSACTION_ERROR: 29201 04:59:49 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:49 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x5}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={r2, 0x81}, &(0x7f00000000c0)=0x8) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xffffff7f, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:49 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd000000]}) 04:59:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000060000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3482.893340] binder: 15739:15740 got transaction with invalid offsets ptr [ 3482.903366] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3482.911988] tc_dump_action: action bad kind [ 3482.921238] binder: 15739:15740 transaction failed 29201/-14, size 0-9 line 2995 [ 3482.938206] CUSE: DEVNAME unspecified 04:59:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:49 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}) 04:59:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x5429, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3482.960985] CUSE: DEVNAME unspecified [ 3482.966992] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000010000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:49 executing program 2: r0 = socket$inet6(0xa, 0x9, 0x5) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="580000000000000001ffee000000000007000000f64cf9e8b53ccfbc17f2559f40e19f489ce638a100dfc55a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f7400000000000000000000000000"], 0x58) [ 3483.002107] binder: undelivered TRANSACTION_ERROR: 29201 04:59:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3483.070709] binder: 15764:15771 got transaction with invalid offsets ptr [ 3483.080128] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3483.088821] tc_dump_action: action bad kind [ 3483.099787] binder: 15764:15771 transaction failed 29201/-14, size 0-9 line 2995 04:59:49 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}) [ 3483.166862] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3483.211633] binder: undelivered TRANSACTION_ERROR: 29201 04:59:50 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf00000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:50 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000700000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:50 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}) 04:59:50 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f00000011c0)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3483.783756] binder: 15803:15805 got transaction with invalid offsets ptr [ 3483.801671] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3483.809659] binder: 15803:15805 transaction failed 29201/-14, size 0-9 line 2995 [ 3483.810322] tc_dump_action: action bad kind 04:59:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) 04:59:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3483.836904] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3483.853044] CUSE: DEVNAME unspecified [ 3483.871486] CUSE: DEVNAME unspecified 04:59:50 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000003000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf0ffffff00000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:50 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getpeername$packet(r1, &(0x7f0000000000), &(0x7f0000000040)=0x14) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3483.892731] binder: undelivered TRANSACTION_ERROR: 29201 04:59:50 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000490c0200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:50 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000]}) [ 3483.992928] binder: 15835:15836 got transaction with invalid offsets ptr [ 3484.021584] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3484.030377] tc_dump_action: action bad kind [ 3484.042298] binder: 15835:15836 transaction failed 29201/-14, size 0-9 line 2995 [ 3484.075766] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3484.148698] binder: undelivered TRANSACTION_ERROR: 29201 [ 3484.149075] CUSE: DEVNAME unspecified 04:59:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:51 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:51 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:51 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000fdfdffff000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}) 04:59:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x5, 0x248901) writev(r0, &(0x7f0000000080)=[{&(0x7f00000011c0)="c8c2a7e164edfdf1f6265e4dccf976d0fe5aa948f45f71967651f2e64e6f505dc0572e381419954923967f99385d1b1c901832fc7e698d9370703a05d1d3c1afeee56f152221c11c0d2fa5f63ca711b8ff1d28df56f548b4ff222ad50536aa3769c18adce4dcdcd93b9b2ed69fab19ae592753b49132f4417c46bf3f925fffc4f560126e851ddda1cae81e49439cd97df8edab6064a55b8a374aca3d5c8a9265507ebf2bc30eb93506b2e88d95e9250416bcd83f4200074c61c4a440dc78136064168e19d4cf4facd558d8763461ff726ceca72e87dc0378", 0xd8}, {&(0x7f00000012c0)="cdf814d9bfedfe10d0e4ff1569f0bfd87af51c27ce12fd6e559da5c3a3374dd658cd948bcfa5c28b3f9bcda3cabb81b107080a8f376cd28e0963e9dc190db0b5188f722f68ff10747342764ffb6b819ba6fb9acf32670494389d5f7fcdf5af5e608757ea8e4b6402edf2e1533efbcef67c48f32eb7a94ff2087a1cd659d9afc896f6ed22c0fd4dc247c220621c605211dd787e5e5622322edf3f0f9bdaf8dfb75f8ee96e05740e5a2dae1c8fc7101fb71b8a88c9c546fa7b3650929467e1332f8dd5d6faa55b1d48", 0xc8}], 0x2) write$cgroup_int(r1, &(0x7f0000000040)={[0x37, 0x3f, 0x0, 0x30, 0x36, 0x0]}, 0x6) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00000000c0)={0x2}) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3484.665592] binder: 15864:15865 got transaction with invalid offsets ptr [ 3484.688337] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3484.696987] tc_dump_action: action bad kind [ 3484.719700] binder: 15864:15865 transaction failed 29201/-14, size 0-9 line 2995 [ 3484.729714] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00]}) 04:59:51 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000004c000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:51 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf0ffff, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:51 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/vcs\x00', 0x101000, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x1, 0x7) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3484.795078] binder: undelivered TRANSACTION_ERROR: 29201 [ 3484.864198] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3484.873104] tc_dump_action: action bad kind [ 3484.882321] binder: 15894:15899 got transaction with invalid offsets ptr [ 3484.933190] CUSE: DEVNAME unspecified [ 3484.947186] binder: 15894:15899 transaction failed 29201/-14, size 0-9 line 2995 [ 3484.962539] CUSE: DEVNAME unspecified [ 3485.028318] binder: undelivered TRANSACTION_ERROR: 29201 04:59:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000400", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00]}) 04:59:52 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x29540000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:52 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:52 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:52 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="580000000000000000000007000000f64cf916f596736268914aad0412cf3ee8b5a809e3adbd3e259cdbe53ccfbc17f25d9f40e19f489ce600ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74000000000043dd62"], 0xffffffffffffffa1) ioctl$DRM_IOCTL_INFO_BUFS(r1, 0xc0106418, &(0x7f0000000000)={0x8, 0x10000, 0x100, 0x3, 0x15, 0x101}) 04:59:52 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000068000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3485.601051] binder: 15921:15927 got transaction with invalid offsets ptr [ 3485.613602] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3485.622311] tc_dump_action: action bad kind [ 3485.635665] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:52 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}) [ 3485.644711] binder: 15921:15927 transaction failed 29201/-14, size 0-9 line 2995 04:59:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000007fffffff00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3485.724793] binder: undelivered TRANSACTION_ERROR: 29201 [ 3485.799652] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:53 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000050000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf00000000000000]}) 04:59:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x20002, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) 04:59:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf0, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:53 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000002b000", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000020c4900", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3486.525900] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3486.534570] tc_dump_action: action bad kind [ 3486.543502] binder: 15964:15971 got transaction with invalid offsets ptr 04:59:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000]}) 04:59:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xffffff9e, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x400, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x80, 0x0) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000001100)={0x0, r2}) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001140)='/dev/cuse\x00', 0x202, 0x0) pread64(r3, &(0x7f0000000100)=""/4096, 0x1000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x8) write$fuse(r3, &(0x7f0000000040)=ANY=[@ANYRES32=r0], 0x4) [ 3486.580361] binder: 15964:15971 transaction failed 29201/-14, size 0-9 line 2995 04:59:53 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:53 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}) 04:59:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000070000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3486.739347] tc_dump_action: action bad kind [ 3486.756259] binder: undelivered TRANSACTION_ERROR: 29201 [ 3486.834099] binder: 16009:16011 got transaction with invalid offsets ptr [ 3486.872766] binder: 16009:16011 transaction failed 29201/-14, size 0-9 line 2995 [ 3486.920699] binder: undelivered TRANSACTION_ERROR: 29201 04:59:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00`\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x200000000000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:54 executing program 2: r0 = socket$inet6(0xa, 0x400001, 0xfffffbfffffffffd) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80080, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x107a, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000010000000000000007000000f64c3dae4a7181b0bb92f916f596736268914aad0600000000000000bc17f25dac40e19f489ce638ac3c480700000030b0c702d8a91dd32efcc889a7c0dd3c73194b0a7c35b482b6ed2c0f74"], 0x58) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000001100)=ANY=[@ANYBLOB="0100000000000000fff8ffffffffffffb15abec501000080010000000000000001000000010000008100000000000000ff7f0000000000000000000000000000040000000000000000020000000000000000000000000000"]) 04:59:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}) 04:59:54 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:54 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000006c0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3487.383295] nla_parse: 1 callbacks suppressed [ 3487.383304] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3487.396574] tc_dump_action: action bad kind [ 3487.405086] binder: 16022:16023 got transaction with invalid offsets ptr [ 3487.418558] xt_check_match: 2 callbacks suppressed [ 3487.418573] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a]}) 04:59:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x9effffff00000000, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3487.437545] binder: 16022:16023 transaction failed 29201/-14, size 0-9 line 2995 [ 3487.487982] binder: undelivered TRANSACTION_ERROR: 29201 04:59:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000a5020000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:54 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:54 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}) 04:59:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="299ae1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)={0x14, 0x0, 0x1, @fuse_poll_out={0x6}}, 0x14) 04:59:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:54 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xf00, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3488.277050] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3488.285631] tc_dump_action: action bad kind [ 3488.292283] binder: 16062:16067 got transaction with invalid offsets ptr 04:59:55 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0x10000008) ioctl(r0, 0x2, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$sock_ipx_SIOCIPXCFGDATA(r1, 0x89e2, &(0x7f0000000000)) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}) 04:59:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0xc500, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:55 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3488.335320] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3488.358365] binder: 16062:16067 transaction failed 29201/-14, size 0-9 line 2995 04:59:55 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:55 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000004c0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3488.479137] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3488.487780] tc_dump_action: action bad kind [ 3488.501925] binder: undelivered TRANSACTION_ERROR: 29201 04:59:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}) 04:59:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3488.547204] CUSE: DEVNAME unspecified [ 3488.547313] binder: 16107:16108 got transaction with invalid offsets ptr [ 3488.553062] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3488.574133] binder: 16107:16108 transaction failed 29201/-14, size 0-9 line 2995 [ 3488.669009] binder: undelivered TRANSACTION_ERROR: 29201 04:59:55 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x400300, 0x0, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:55 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000120000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}) 04:59:55 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:55 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3489.189934] binder: 16132:16133 got transaction with invalid offsets ptr [ 3489.205854] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3489.214489] tc_dump_action: action bad kind 04:59:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:55 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]}) [ 3489.236184] binder: 16132:16133 transaction failed 29201/-14, size 0-9 line 2995 [ 3489.245368] CUSE: DEVNAME unspecified [ 3489.279644] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:56 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3489.301978] CUSE: DEVNAME unspecified 04:59:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x9effffff00000000, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:56 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000060000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:56 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}) 04:59:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000000)=0x32, &(0x7f0000000040)=0x2) write$fuse(r1, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489c3c38ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) [ 3489.349345] binder: undelivered TRANSACTION_ERROR: 29201 [ 3489.386143] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3489.394754] tc_dump_action: action bad kind 04:59:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3489.483131] binder: 16166:16169 got transaction with invalid offsets ptr [ 3489.509604] CUSE: DEVNAME unspecified [ 3489.524784] binder: 16166:16169 transaction failed 29201/-14, size 0-9 line 2995 04:59:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) 04:59:56 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3489.536469] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3489.594331] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3489.603091] tc_dump_action: action bad kind [ 3489.629364] binder: undelivered TRANSACTION_ERROR: 29201 04:59:56 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf0ffffff00000000, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:56 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:56 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000001700000000000000000000e0a2020000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'mangle\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}) 04:59:56 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3490.089192] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3490.097803] tc_dump_action: action bad kind [ 3490.116441] binder: 16206:16209 got transaction with invalid offsets ptr 04:59:56 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:56 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}) [ 3490.145282] binder: 16206:16209 transaction failed 29201/-14, size 0-9 line 2995 [ 3490.153653] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3490.172402] CUSE: DEVNAME unspecified 04:59:56 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000030000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:56 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf0ffffffffffff, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:56 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3490.243818] binder: undelivered TRANSACTION_ERROR: 29201 [ 3490.307161] binder: 16231:16233 got transaction with invalid offsets ptr [ 3490.319123] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3490.327914] tc_dump_action: action bad kind [ 3490.364517] binder: 16231:16233 transaction failed 29201/-14, size 0-9 line 2995 [ 3490.396144] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3490.427688] binder: undelivered TRANSACTION_ERROR: 29201 04:59:57 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:57 executing program 2: membarrier(0x2, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x80000000}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000011c0)={r1, @in6={{0xa, 0x4e20, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x4}}}, 0x84) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r2, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}) 04:59:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xffffff7f, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:57 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:57 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000a0000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3490.987517] binder: 16256:16259 got transaction with invalid offsets ptr [ 3491.001264] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3491.009861] tc_dump_action: action bad kind 04:59:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}) 04:59:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf000000, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3491.033691] binder: 16256:16259 transaction failed 29201/-14, size 0-9 line 2995 [ 3491.046258] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3491.056237] CUSE: DEVNAME unspecified 04:59:57 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:57 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000000a0000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3491.154135] binder: undelivered TRANSACTION_ERROR: 29201 04:59:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}) 04:59:57 executing program 2: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r0, &(0x7f00000011c0)=""/4096, 0xfffffef8, 0x0) write$fuse(r0, &(0x7f0000001100)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d865664ed00213dd13c0dd3cd0194b0a7c35b482b6ed2c0f74"], 0x58) [ 3491.211185] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3491.235089] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3491.243766] tc_dump_action: action bad kind 04:59:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3491.261704] binder: 16293:16298 got transaction with invalid offsets ptr [ 3491.289769] CUSE: DEVNAME unspecified 04:59:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800]}) 04:59:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xffffff9e, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3491.317470] binder: 16293:16298 transaction failed 29201/-14, size 0-9 line 2995 [ 3491.398634] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3491.443567] binder: undelivered TRANSACTION_ERROR: 29201 04:59:58 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:58 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000007fffffff0000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:58 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)=0x2) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 04:59:58 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c]}) 04:59:58 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc5000000, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:58 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:58 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3491.907833] tc_dump_action: action bad kind [ 3491.920259] binder: 16333:16343 got transaction with invalid offsets ptr [ 3491.945703] binder: 16333:16343 transaction failed 29201/-14, size 0-9 line 2995 [ 3491.982226] CUSE: DEVNAME unspecified [ 3492.045601] binder: undelivered TRANSACTION_ERROR: 29201 04:59:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}) 04:59:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 04:59:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x2000000, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000040000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:59 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 04:59:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f742e2a29d0f580be9d3eb08c21945fbf7aa04bc7f71b2c6f520bbf75ddfb3ef673fb2bd95921c868d14caa623f96668d9da3bba38c99a0126de046d956f797a30294a0969d192a01515fbed7a691d1b3f99b5653492f237c39bb2b87dec9d39eb49f8411503081ca332e28907595c104a7037f0a263118c2720dda8414185f93010f45"], 0x58) [ 3492.754000] nla_parse: 1 callbacks suppressed [ 3492.758669] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3492.767228] tc_dump_action: action bad kind [ 3492.779286] binder: 16358:16367 got transaction with invalid offsets ptr 04:59:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc500, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000]}) [ 3492.801321] binder: 16358:16367 transaction failed 29201/-14, size 0-9 line 2995 [ 3492.815268] xt_check_match: 1 callbacks suppressed [ 3492.815282] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3492.819462] CUSE: DEVNAME unspecified 04:59:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000004c0000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3492.906666] binder: undelivered TRANSACTION_ERROR: 29201 04:59:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 04:59:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000]}) [ 3492.979364] binder: 16396:16398 got transaction with invalid offsets ptr [ 3492.997640] CUSE: DEVNAME unspecified [ 3493.009951] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3493.013407] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 04:59:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc00e, {0x10}}, 0xe1}, 0x1}, 0x0) 04:59:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$KVM_SMI(r1, 0xaeb7) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x97, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) [ 3493.018703] tc_dump_action: action bad kind [ 3493.033193] binder: 16396:16398 transaction failed 29201/-14, size 0-9 line 2995 04:59:59 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000b00200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 04:59:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000002000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 04:59:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3493.124491] binder: undelivered TRANSACTION_ERROR: 29201 [ 3493.181222] binder: 16418:16419 got transaction with invalid offsets ptr [ 3493.214310] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3493.234287] binder: 16418:16419 transaction failed 29201/-14, size 0-9 line 2995 [ 3493.322461] binder: undelivered TRANSACTION_ERROR: 29201 05:00:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00]}) 05:00:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf00, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000008800", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:00 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x1) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r0, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001300)=ANY=[@ANYBLOB="5800000000000000010000000002000007000000164c099df596736268914aade611cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c706000000d32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74ba8044516ed6303cb2ccb2d77fd2471742755c04b34f87ebd622446292190ff5d5fba2d51937eaccef7021440dda9e18d8e12e092ff58649d6d44f20a86448c5980041198bf91563c029448f11d73b93f73c8f4728a4017ad3cb6e370697a7ca2280aa6cca4b4c"], 0x58) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = inotify_add_watch(r1, &(0x7f0000001100)='./file0\x00', 0x100) inotify_rm_watch(r1, r3) symlink(&(0x7f0000001140)='./file0\x00', &(0x7f0000001240)='./file1\x00') r4 = geteuid() lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r2, r4, r5) 05:00:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:00 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000004800000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3493.670703] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3493.679338] tc_dump_action: action bad kind [ 3493.686089] binder: 16440:16441 got transaction with invalid offsets ptr 05:00:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x5429, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3493.714862] binder: 16440:16441 transaction failed 29201/-14, size 0-9 line 2995 [ 3493.718904] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 05:00:00 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="295ee1311f16f477671070e8af6a99caf3bf10") r1 = syz_open_dev$vcsn(&(0x7f0000001200)='/dev/vcs#\x00', 0x1, 0x0) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000001240)=""/4096) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r2, 0xc058534b, &(0x7f0000002240)={0x0, 0x3, 0x78c, 0x7, 0x8, 0x1000}) mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8003, &(0x7f00000000c0)=0xb0c, 0xb6, 0x1) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x202, 0x0) pread64(r3, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r3, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) 05:00:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}) 05:00:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000093000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) [ 3493.869427] binder: undelivered TRANSACTION_ERROR: 29201 05:00:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:00 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000]}) 05:00:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3493.919739] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3493.928574] tc_dump_action: action bad kind [ 3493.940895] binder: 16485:16486 got transaction with invalid offsets ptr [ 3493.949296] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3493.950621] binder: 16485:16486 transaction failed 29201/-14, size 0-9 line 2995 [ 3494.003834] CUSE: DEVNAME unspecified 05:00:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:00 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000480000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc500000000000000, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3494.058733] binder: undelivered TRANSACTION_ERROR: 29201 [ 3494.089504] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 05:00:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3494.114531] binder: 16505:16506 got transaction with invalid offsets ptr [ 3494.134406] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3494.142120] binder: 16505:16506 transaction failed 29201/-14, size 0-9 line 2995 [ 3494.143044] tc_dump_action: action bad kind [ 3494.230521] binder: undelivered TRANSACTION_ERROR: 29201 05:00:01 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) ioctl$TIOCEXCL(r1, 0x540c) pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="5800000000000000010000000000000007000000f64cf916f596736268914aad0412cf3ee8b53ccf9d40016563bc17f25d9f402eb2a7e36fc23dace19f489ce638ac3c48ea5a791930b0c702d81bb5321258707bb5c0799e44c36690d0194b0a"], 0x58) 05:00:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd00000000000000]}) 05:00:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000007fffffe00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x200000000000000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000480000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:01 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:01 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3494.522612] binder: 16527:16528 got transaction with invalid offsets ptr [ 3494.554375] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3494.563085] tc_dump_action: action bad kind 05:00:01 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000]}) [ 3494.569810] binder: 16527:16528 transaction failed 29201/-14, size 0-9 line 2995 [ 3494.590834] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3494.601380] CUSE: DEVNAME unspecified [ 3494.655971] binder: undelivered TRANSACTION_ERROR: 29201 05:00:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xfffff000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000600000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:02 executing program 2: r0 = socket$inet6(0xa, 0x8, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) pread64(r1, &(0x7f00000011c0)=""/4096, 0xffffffffffffff47, 0xfffffffffffffffd) write(r1, &(0x7f0000000000)="8e4f932a2f7fbd2544df87e7fbe49338f43959c80833c6df3a1c141288013d9b768fd6b82bdad958bfddd327e4f59c9dad61bfe0266b7a98f0daf27894c65dc454da13075ccfb45e4e6afcdf9a4a015c0e76e3455bad3ce9c626c4f94c64ebed25761ad76f8f6e257c222768ea8c82b26c20aa255c7b4e7ab1545a44a73779d8d3eb7d960ee86ee46a825522e41e5d3ff265b626760798993b2aa7eec81ed98c7827bb67ca4f512cfdf6c3290b9cdd04e732238a4212ad63cfd85006f9f0a409e5326c9e0a10655c3eca32076c061790cd5c18876b4279d23d080284b706da94b7db96a2c495aea7fb7343", 0xeb) 05:00:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:02 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}) [ 3495.433466] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3495.442248] tc_dump_action: action bad kind [ 3495.458106] binder: 16565:16569 got transaction with invalid offsets ptr 05:00:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf000000]}) [ 3495.505404] binder: 16565:16569 transaction failed 29201/-14, size 0-9 line 2995 [ 3495.513543] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 05:00:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x1000000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:02 executing program 2: 05:00:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000020000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00]}) 05:00:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3495.635743] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3495.644600] tc_dump_action: action bad kind [ 3495.662564] binder: undelivered TRANSACTION_ERROR: 29201 05:00:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3495.754846] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3495.765327] binder: 16613:16614 got transaction with invalid offsets ptr 05:00:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) 05:00:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000200", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:02 executing program 2: [ 3495.804408] binder: 16613:16614 transaction failed 29201/-14, size 0-9 line 2995 [ 3495.813694] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3495.823153] tc_dump_action: action bad kind 05:00:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3495.945982] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3495.956500] binder: undelivered TRANSACTION_ERROR: 29201 05:00:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc5, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000]}) 05:00:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063404000000000000000000000170000000000000000000000006c0000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:03 executing program 2: 05:00:03 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:03 executing program 2: 05:00:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000]}) [ 3496.354968] binder: 16648:16650 got transaction with invalid offsets ptr [ 3496.378883] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3496.387538] tc_dump_action: action bad kind [ 3496.390701] binder: 16648:16650 transaction failed 29201/-14, size 0-9 line 2995 05:00:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x40030000000000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:03 executing program 2: 05:00:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000500000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3496.507782] binder: undelivered TRANSACTION_ERROR: 29201 [ 3496.563852] tc_dump_action: action bad kind 05:00:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400]}) 05:00:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) dup2(r3, r2) [ 3496.585592] binder: 16680:16681 got transaction with invalid offsets ptr 05:00:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) [ 3496.633397] binder: 16680:16681 transaction failed 29201/-14, size 0-9 line 2995 05:00:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3496.760924] binder: undelivered TRANSACTION_ERROR: 29201 [ 3496.788490] tc_dump_action: action bad kind 05:00:03 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000007a00000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}) 05:00:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf00000000000000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:03 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000530ff8)=0x4) listen(r0, 0x0) shutdown(r0, 0x0) 05:00:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:03 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd]}) 05:00:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000002, 0x52, r0, 0x0) madvise(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xa) openat$vcs(0xffffffffffffff9c, &(0x7f0000000ff7)='/dev/vcs\x00', 0x0, 0x0) [ 3497.226358] tc_dump_action: action bad kind [ 3497.229843] binder: 16726:16734 got transaction with invalid offsets ptr [ 3497.263202] binder: 16726:16734 transaction failed 29201/-14, size 0-9 line 2995 05:00:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf0ffffff, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c746572000000000000000000007fffffff00", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000050000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3497.334361] binder: undelivered TRANSACTION_ERROR: 29201 05:00:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3497.429517] tc_dump_action: action bad kind [ 3497.443170] binder: 16762:16765 got transaction with invalid offsets ptr [ 3497.464716] binder: 16762:16765 transaction failed 29201/-14, size 0-9 line 2995 [ 3497.563211] binder: undelivered TRANSACTION_ERROR: 29201 05:00:04 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x400300, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74]}) 05:00:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001180)='/dev/cuse\x00', 0x202, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x80000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000011c0)={0x0}, &(0x7f0000001200)=0xc) syz_open_procfs(r3, &(0x7f0000001240)='wchan\x00') pread64(r1, &(0x7f0000000100)=""/4096, 0x1000, 0x0) write$fuse(r1, &(0x7f0000001100)={0x58, 0x0, 0x1, @random="07000000f64cf916f596736268914aad0412cf3ee8b53ccfbc17f25d9f40e19f489ce638ac3c48ea5a791930b0c702d8a91dd32e796689a7c0dd3cd0194b0a7c35b482b6ed2c0f74"}, 0x58) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000080)=""/121) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000)=0xe3ef, 0x4) 05:00:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c7465720000000000000000000000020c4900", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000600000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3498.140680] binder: 16783:16789 got transaction with invalid offsets ptr [ 3498.143966] nla_parse: 4 callbacks suppressed [ 3498.143975] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3498.160761] tc_dump_action: action bad kind [ 3498.170222] binder: 16783:16789 transaction failed 29201/-14, size 0-9 line 2995 [ 3498.185117] xt_check_match: 5 callbacks suppressed 05:00:04 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) 05:00:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xfffffffffffff000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3498.185128] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3498.206996] CUSE: DEVNAME unspecified 05:00:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000001100", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000006800000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:04 executing program 2 (fault-call:8 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mmap(&(0x7f0000003000/0xffc000)=nil, 0xffc000, 0x2, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xfffffdef, 0x40, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c) [ 3498.291901] binder: undelivered TRANSACTION_ERROR: 29201 05:00:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000]}) [ 3498.365921] binder: 16818:16819 got transaction with invalid offsets ptr [ 3498.379857] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3498.388599] tc_dump_action: action bad kind [ 3498.406657] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3498.430131] binder: 16818:16819 transaction failed 29201/-14, size 0-9 line 2995 [ 3498.456352] FAULT_INJECTION: forcing a failure. [ 3498.456352] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3498.468287] CPU: 0 PID: 16827 Comm: syz-executor2 Not tainted 4.17.0+ #91 [ 3498.475221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3498.484581] Call Trace: [ 3498.487193] dump_stack+0x1b9/0x294 [ 3498.490838] ? dump_stack_print_info.cold.2+0x52/0x52 [ 3498.496154] ? page_add_file_rmap+0x779/0xe20 [ 3498.500694] should_fail.cold.4+0xa/0x1a [ 3498.504715] binder_alloc: binder_alloc_mmap_handler: 16818 20001000-20004000 already mapped failed -16 [ 3498.504767] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 3498.519307] ? print_usage_bug+0xc0/0xc0 [ 3498.523417] ? find_held_lock+0x36/0x1c0 [ 3498.527503] ? lock_acquire+0x1dc/0x520 [ 3498.531493] ? alloc_set_pte+0x1013/0x1600 [ 3498.535750] ? print_usage_bug+0xc0/0xc0 [ 3498.539838] ? reacquire_held_locks+0xbc/0x3e0 [ 3498.544436] ? alloc_set_pte+0x1013/0x1600 [ 3498.548694] ? find_held_lock+0x13f/0x1c0 [ 3498.552867] __alloc_pages_nodemask+0x34e/0xd70 [ 3498.557554] ? unlock_page+0x1d0/0x2b0 [ 3498.561453] ? __alloc_pages_slowpath+0x2d50/0x2d50 [ 3498.566484] ? debug_check_no_locks_freed+0x310/0x310 [ 3498.571695] ? print_usage_bug+0xc0/0xc0 [ 3498.575768] ? print_usage_bug+0xc0/0xc0 [ 3498.579849] ? debug_check_no_locks_freed+0x310/0x310 [ 3498.585050] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 3498.590612] alloc_pages_current+0x10c/0x210 [ 3498.595028] skb_page_frag_refill+0x453/0x6a0 [ 3498.599521] ? graph_lock+0x170/0x170 [ 3498.603310] ? sock_kzfree_s+0x60/0x60 [ 3498.607187] ? debug_check_no_locks_freed+0x310/0x310 [ 3498.612374] ? print_usage_bug+0xc0/0xc0 [ 3498.616438] ? find_held_lock+0x36/0x1c0 [ 3498.620498] sk_page_frag_refill+0x55/0x1f0 [ 3498.624822] sk_alloc_sg+0x1df/0x9b0 [ 3498.628532] ? sk_page_frag_refill+0x1f0/0x1f0 [ 3498.633106] ? __local_bh_enable_ip+0x161/0x230 [ 3498.637761] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3498.642763] ? lock_sock_nested+0x9f/0x120 [ 3498.646986] ? trace_hardirqs_on+0xd/0x10 [ 3498.651120] ? __local_bh_enable_ip+0x161/0x230 [ 3498.655783] tls_sw_sendmsg+0x575/0x12b0 [ 3498.660266] ? expand_files.part.8+0x9a0/0x9a0 [ 3498.664843] ? check_same_owner+0x320/0x320 [ 3498.669166] ? tls_sw_push_pending_record+0x30/0x30 [ 3498.674168] ? lock_downgrade+0x8e0/0x8e0 [ 3498.678302] ? lock_release+0xa10/0xa10 [ 3498.682351] ? __check_object_size+0x95/0x5d9 [ 3498.686846] inet_sendmsg+0x19f/0x690 [ 3498.690631] ? __might_sleep+0x95/0x190 [ 3498.694592] ? ipip_gro_receive+0x100/0x100 [ 3498.698904] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3498.704432] ? security_socket_sendmsg+0x94/0xc0 [ 3498.709175] ? ipip_gro_receive+0x100/0x100 [ 3498.713486] sock_sendmsg+0xd5/0x120 [ 3498.717188] __sys_sendto+0x3d7/0x670 [ 3498.721008] ? __ia32_sys_getpeername+0xb0/0xb0 [ 3498.725678] ? wait_for_completion+0x870/0x870 [ 3498.730253] ? __lock_is_held+0xb5/0x140 [ 3498.734325] ? __sb_end_write+0xac/0xe0 [ 3498.738290] ? fput+0x130/0x1a0 [ 3498.741560] ? ksys_write+0x1a6/0x250 [ 3498.745351] ? __ia32_sys_read+0xb0/0xb0 [ 3498.749403] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 3498.754246] __x64_sys_sendto+0xe1/0x1a0 [ 3498.758295] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3498.763297] do_syscall_64+0x1b1/0x800 [ 3498.767180] ? finish_task_switch+0x1ca/0x840 [ 3498.771663] ? syscall_return_slowpath+0x5c0/0x5c0 [ 3498.776580] ? syscall_return_slowpath+0x30f/0x5c0 [ 3498.781509] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 3498.786874] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3498.791705] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3498.796888] RIP: 0033:0x4559f9 [ 3498.800058] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3498.819288] RSP: 002b:00007fc449b56c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3498.826985] RAX: ffffffffffffffda RBX: 00007fc449b576d4 RCX: 00000000004559f9 [ 3498.834254] RDX: 00000000fffffdef RSI: 00000000200005c0 RDI: 0000000000000013 [ 3498.841518] RBP: 000000000072bea0 R08: 0000000020000000 R09: 000000000000001c [ 3498.848770] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000015 [ 3498.856026] R13: 00000000004c0d3b R14: 00000000004d07a8 R15: 0000000000000000 [ 3498.865577] binder: undelivered TRANSACTION_ERROR: 29201 05:00:05 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}) 05:00:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={"66696c74657200000000000000000000000500", 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000700000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:05 executing program 2 (fault-call:8 fault-nth:1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mmap(&(0x7f0000003000/0xffc000)=nil, 0xffc000, 0x2, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xfffffdef, 0x40, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c) [ 3499.019690] binder: 16843:16845 got transaction with invalid offsets ptr [ 3499.036830] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3499.045477] tc_dump_action: action bad kind [ 3499.047412] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3499.072305] binder: 16843:16845 transaction failed 29201/-14, size 0-9 line 2995 [ 3499.102938] FAULT_INJECTION: forcing a failure. [ 3499.102938] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3499.114859] CPU: 0 PID: 16861 Comm: syz-executor2 Not tainted 4.17.0+ #91 05:00:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000120000000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xf, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3499.115740] binder: undelivered TRANSACTION_ERROR: 29201 [ 3499.121804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3499.121811] Call Trace: [ 3499.121839] dump_stack+0x1b9/0x294 [ 3499.121862] ? dump_stack_print_info.cold.2+0x52/0x52 [ 3499.121881] ? page_add_file_rmap+0x779/0xe20 [ 3499.121903] should_fail.cold.4+0xa/0x1a [ 3499.121925] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 3499.121960] ? trace_hardirqs_on+0xd/0x10 [ 3499.166204] ? try_charge+0xaae/0x1630 05:00:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3499.170114] ? down_read+0xaf/0x1b0 [ 3499.173755] ? get_user_pages_unlocked+0xf4/0x5b0 [ 3499.178622] ? __mem_cgroup_largest_soft_limit_node.part.60+0x6a0/0x6a0 [ 3499.185399] ? graph_lock+0x170/0x170 [ 3499.189223] ? up_read+0x1a/0x110 [ 3499.192698] ? print_usage_bug+0xc0/0xc0 [ 3499.196780] ? get_user_pages_longterm+0x630/0x630 [ 3499.201729] ? get_user_pages_fast+0x223/0x440 [ 3499.206337] __alloc_pages_nodemask+0x34e/0xd70 [ 3499.211031] ? mark_held_locks+0xc9/0x160 [ 3499.215196] ? __alloc_pages_slowpath+0x2d50/0x2d50 05:00:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00]}) [ 3499.220235] ? mem_cgroup_charge_skmem+0x17f/0x340 [ 3499.225181] ? mem_cgroup_sk_free+0x90/0x90 [ 3499.229521] ? print_usage_bug+0xc0/0xc0 [ 3499.233638] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3499.239187] ? tcp_leave_memory_pressure+0x47/0xf0 [ 3499.244563] ? tcp_push+0x8a0/0x8a0 [ 3499.248207] ? __sk_mem_raise_allocated+0x882/0x15e0 [ 3499.253338] ? sk_busy_loop_end+0x1b0/0x1b0 [ 3499.257680] ? debug_check_no_locks_freed+0x310/0x310 [ 3499.262905] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 3499.268474] alloc_pages_current+0x10c/0x210 05:00:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x9effffff, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}) [ 3499.273249] skb_page_frag_refill+0x453/0x6a0 [ 3499.277760] ? graph_lock+0x170/0x170 [ 3499.281571] ? sock_kzfree_s+0x60/0x60 [ 3499.285479] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3499.291022] ? zerocopy_from_iter.constprop.11+0x486/0x620 [ 3499.296665] sk_page_frag_refill+0x55/0x1f0 [ 3499.300996] sk_alloc_sg+0x1df/0x9b0 [ 3499.304731] ? sk_page_frag_refill+0x1f0/0x1f0 [ 3499.309343] ? free_sg+0x520/0x520 [ 3499.312896] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3499.317937] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 3499.322968] ? __local_bh_enable_ip+0x161/0x230 [ 3499.327659] tls_sw_sendmsg+0x676/0x12b0 [ 3499.331736] ? expand_files.part.8+0x9a0/0x9a0 [ 3499.336330] ? check_same_owner+0x320/0x320 [ 3499.340682] ? tls_sw_push_pending_record+0x30/0x30 [ 3499.345718] ? lock_downgrade+0x8e0/0x8e0 [ 3499.349886] ? lock_release+0xa10/0xa10 [ 3499.353979] ? __check_object_size+0x95/0x5d9 [ 3499.358498] inet_sendmsg+0x19f/0x690 [ 3499.362467] ? __might_sleep+0x95/0x190 [ 3499.366465] ? ipip_gro_receive+0x100/0x100 [ 3499.370807] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3499.376362] ? security_socket_sendmsg+0x94/0xc0 [ 3499.381131] ? ipip_gro_receive+0x100/0x100 [ 3499.385487] sock_sendmsg+0xd5/0x120 [ 3499.389216] __sys_sendto+0x3d7/0x670 [ 3499.393033] ? __ia32_sys_getpeername+0xb0/0xb0 [ 3499.397715] ? wait_for_completion+0x870/0x870 [ 3499.402313] ? __lock_is_held+0xb5/0x140 [ 3499.406393] ? __sb_end_write+0xac/0xe0 [ 3499.410379] ? fput+0x130/0x1a0 [ 3499.413667] ? ksys_write+0x1a6/0x250 [ 3499.417484] ? __ia32_sys_read+0xb0/0xb0 05:00:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3499.421568] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 3499.426425] __x64_sys_sendto+0xe1/0x1a0 [ 3499.430844] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3499.435877] do_syscall_64+0x1b1/0x800 [ 3499.439839] ? finish_task_switch+0x1ca/0x840 [ 3499.444351] ? syscall_return_slowpath+0x5c0/0x5c0 [ 3499.449296] ? syscall_return_slowpath+0x30f/0x5c0 [ 3499.454242] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 3499.459643] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3499.464506] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3499.469706] RIP: 0033:0x4559f9 [ 3499.472893] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3499.492628] RSP: 002b:00007fc449b56c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3499.500386] RAX: ffffffffffffffda RBX: 00007fc449b576d4 RCX: 00000000004559f9 [ 3499.502988] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3499.509253] RDX: 00000000fffffdef RSI: 00000000200005c0 RDI: 0000000000000013 [ 3499.509263] RBP: 000000000072bea0 R08: 0000000020000000 R09: 000000000000001c [ 3499.509269] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000015 [ 3499.509277] R13: 00000000004c0d3b R14: 00000000004d07a8 R15: 0000000000000001 [ 3499.548010] tc_dump_action: action bad kind [ 3499.560095] binder: 16869:16881 got transaction with invalid offsets ptr [ 3499.567346] binder: 16869:16881 transaction failed 29201/-14, size 0-9 line 2995 [ 3499.596535] binder: undelivered TRANSACTION_ERROR: 29201 05:00:06 executing program 1: r0 = socket(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) recvmmsg(r0, &(0x7f0000003980)=[{{&(0x7f0000002b00)=@l2, 0x80, &(0x7f0000002f40), 0x0, &(0x7f0000002f80)=""/140, 0x8c}}, {{&(0x7f0000003040)=@alg, 0x80, &(0x7f0000003340), 0x0, &(0x7f0000003380)=""/211, 0xd3}}, {{&(0x7f0000003480)=@pppoe={0x0, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000003840), 0x0, &(0x7f0000003880)=""/205, 0xcd}}], 0x3, 0x0, &(0x7f0000001540)={r1}) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1a, 0x201}, 0x14}, 0x1}, 0x0) 05:00:06 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000]}) 05:00:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0xc00e0000, {0x10}}, 0xe1}, 0x1}, 0x0) 05:00:06 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000001050000000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:06 executing program 2 (fault-call:8 fault-nth:2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mmap(&(0x7f0000003000/0xffc000)=nil, 0xffc000, 0x2, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xfffffdef, 0x40, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c) 05:00:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3499.940265] binder: 16909:16910 got transaction with invalid offsets ptr [ 3499.950674] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3499.959463] tc_dump_action: action bad kind [ 3499.963073] binder: 16909:16910 transaction failed 29201/-14, size 0-9 line 2995 05:00:06 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000200)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a0a41f350000000000000000f559b3fd4cec307e8ef1b13ebba00c9c65abaf90d22009492542e5b78f8b29e0a27800f0000f600000000091f0cf376589701a4", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}) 05:00:06 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) 05:00:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) [ 3499.985340] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 05:00:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0xf503}, 0xc, &(0x7f0000000280)={&(0x7f0000000080)={0x1c, 0x27, 0xffffffffffffffff, 0x0, 0x2, {0x10}}, 0xe1}, 0x1}, 0x0) [ 3500.066117] FAULT_INJECTION: forcing a failure. [ 3500.066117] name failslab, interval 1, probability 0, space 0, times 0 [ 3500.074453] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3500.077636] CPU: 1 PID: 16913 Comm: syz-executor2 Not tainted 4.17.0+ #91 [ 3500.086933] tc_dump_action: action bad kind [ 3500.093924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3500.093929] Call Trace: [ 3500.093960] dump_stack+0x1b9/0x294 [ 3500.093980] ? dump_stack_print_info.cold.2+0x52/0x52 [ 3500.094005] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3500.125395] ? __do_page_fault+0x441/0xe40 [ 3500.129635] should_fail.cold.4+0xa/0x1a [ 3500.133688] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 3500.138779] ? tcp_push+0x8a0/0x8a0 [ 3500.143698] ? graph_lock+0x170/0x170 [ 3500.147495] ? graph_lock+0x170/0x170 [ 3500.151294] ? graph_lock+0x170/0x170 [ 3500.155096] ? vmalloc_sync_all+0x30/0x30 [ 3500.159235] ? sk_busy_loop_end+0x1b0/0x1b0 [ 3500.163546] ? find_held_lock+0x36/0x1c0 [ 3500.167684] ? __lock_is_held+0xb5/0x140 [ 3500.171756] ? check_same_owner+0x320/0x320 [ 3500.176165] ? check_same_owner+0x320/0x320 [ 3500.180486] ? rcu_note_context_switch+0x710/0x710 [ 3500.185410] __should_failslab+0x124/0x180 [ 3500.189646] should_failslab+0x9/0x14 [ 3500.193442] __kmalloc+0x2c8/0x760 [ 3500.196994] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 3500.202016] ? _copy_from_iter+0x395/0x1080 [ 3500.206357] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 3500.211454] ? tls_push_record+0x637/0x13e0 [ 3500.215801] tls_push_record+0x637/0x13e0 [ 3500.219953] tls_sw_sendmsg+0x9de/0x12b0 [ 3500.224017] ? tls_sw_push_pending_record+0x30/0x30 [ 3500.229028] ? lock_downgrade+0x8e0/0x8e0 [ 3500.233168] ? lock_release+0xa10/0xa10 [ 3500.237133] ? __check_object_size+0x95/0x5d9 [ 3500.241636] inet_sendmsg+0x19f/0x690 [ 3500.245444] ? __might_sleep+0x95/0x190 [ 3500.250206] ? ipip_gro_receive+0x100/0x100 [ 3500.255153] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3500.260796] ? security_socket_sendmsg+0x94/0xc0 [ 3500.265556] ? ipip_gro_receive+0x100/0x100 [ 3500.269868] sock_sendmsg+0xd5/0x120 [ 3500.273575] __sys_sendto+0x3d7/0x670 [ 3500.277367] ? __ia32_sys_getpeername+0xb0/0xb0 [ 3500.282899] ? wait_for_completion+0x870/0x870 [ 3500.287476] ? schedule+0xef/0x430 [ 3500.291017] ? __sb_end_write+0xac/0xe0 [ 3500.294993] ? exit_to_usermode_loop+0x87/0x310 [ 3500.299659] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3500.305443] ? exit_to_usermode_loop+0x1ef/0x310 [ 3500.310190] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 3500.315030] __x64_sys_sendto+0xe1/0x1a0 [ 3500.319080] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3500.324084] do_syscall_64+0x1b1/0x800 [ 3500.327959] ? finish_task_switch+0x1ca/0x840 [ 3500.332549] ? syscall_return_slowpath+0x5c0/0x5c0 [ 3500.337483] ? syscall_return_slowpath+0x30f/0x5c0 [ 3500.342597] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 3500.347952] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3500.352787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3500.357960] RIP: 0033:0x4559f9 [ 3500.361131] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3500.380365] RSP: 002b:00007fc449b56c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3500.388062] RAX: ffffffffffffffda RBX: 00007fc449b576d4 RCX: 00000000004559f9 [ 3500.395329] RDX: 00000000fffffdef RSI: 00000000200005c0 RDI: 0000000000000013 [ 3500.402594] RBP: 000000000072bea0 R08: 0000000020000000 R09: 000000000000001c [ 3500.409864] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000015 05:00:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x2d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000017000000000000000000000000100000b41d00000000000000000000000009"], 0x0, 0x0, &(0x7f0000000340)}) 05:00:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@filter={'filter\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0xe, 0x2, 0x2b0, [0x0, 0x20000600, 0x20000630, 0x200007e0], 0x0, &(0x7f0000000080), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'team0\x00', 'veth0_to_bond\x00', 'syz_tun\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x150, 0x150, 0x180, [@limit={'limit\x00', 0x20, {{0x0, 0x2}}}, @physdev={'physdev\x00', 0x70, {{'bond_slave_0\x00', {}, 'bridge_slave_1\x00'}}}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'vlan0\x00', 'lo\x00', 'rose0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}]}, 0x328) 05:00:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3}}]}]}, 0x28}, 0x1}, 0x0) 05:00:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) r4 = socket(0xa, 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000005b00)={0x0, 0x0, &(0x7f0000005a00), 0x0, &(0x7f0000005a80)=[@rights={0x28, 0x1, 0x1, [r4, r1, r2, r1, r2]}], 0x28}, 0x0) recvmmsg(r1, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/168, 0xa8}}, {{&(0x7f0000000540)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000800)=""/240, 0xf0}}, {{&(0x7f0000002040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002480)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/247}, {&(0x7f00000001c0)=""/154}, {&(0x7f00000002c0)=""/156}, {&(0x7f0000000900)=""/4096}, {&(0x7f0000000380)=""/103}, {&(0x7f00000005c0)=""/191}, {&(0x7f0000000680)=""/210}, {&(0x7f0000001900)=""/199}, {&(0x7f00000024c0)=""/4096}], 0x0, &(0x7f0000003500)=""/131, 0x83}}, {{0x0, 0x0, &(0x7f0000003900), 0x0, &(0x7f0000003980)=""/114, 0x72}}, {{0x0, 0x0, &(0x7f0000004b80), 0x0, &(0x7f0000004bc0)=""/131, 0x83}}, {{&(0x7f0000004c80)=@nl, 0x80, &(0x7f0000005140), 0x0, &(0x7f00000051c0)=""/57, 0x39}}], 0x343, 0x2, 0x0) [ 3500.417121] R13: 00000000004c0d3b R14: 00000000004d07a8 R15: 0000000000000002 [ 3500.499186] binder: 16937:16941 got transaction with invalid offsets ptr [ 3500.530513] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 3500.536128] binder: 16937:16941 transaction failed 29201/-14, size 0-9 line 2995 [ 3500.539153] tc_dump_action: action bad kind [ 3500.580763] x_tables: eb_tables: physdev.0 match: invalid size 72 (kernel) != (user) 112 [ 3500.636678] binder: undelivered TRANSACTION_ERROR: 29201 [ 3500.642509] ================================================================== [ 3500.650308] BUG: KASAN: use-after-free in tls_push_record+0x1023/0x13e0 [ 3500.656784] binder: undelivered TRANSACTION_ERROR: 29201 [ 3500.657781] Write of size 1 at addr ffff8801c47d0000 by task syz-executor2/16913 [ 3500.657811] [ 3500.657826] CPU: 1 PID: 16913 Comm: syz-executor2 Not tainted 4.17.0+ #91 [ 3500.657833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3500.657842] Call Trace: [ 3500.691278] dump_stack+0x1b9/0x294 [ 3500.694906] ? dump_stack_print_info.cold.2+0x52/0x52 [ 3500.700098] ? printk+0x9e/0xba [ 3500.703377] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 3500.708131] ? kasan_check_write+0x14/0x20 [ 3500.712363] print_address_description+0x6c/0x20b [ 3500.717204] ? tls_push_record+0x1023/0x13e0 [ 3500.721620] kasan_report.cold.7+0x242/0x2fe [ 3500.726024] __asan_report_store1_noabort+0x17/0x20 [ 3500.731030] tls_push_record+0x1023/0x13e0 [ 3500.735269] ? __local_bh_enable_ip+0x161/0x230 [ 3500.739951] tls_sw_push_pending_record+0x22/0x30 [ 3500.744791] tls_push_pending_closed_record+0x10c/0x150 [ 3500.750157] ? lock_sock_nested+0xe7/0x120 [ 3500.754389] tls_sk_proto_close+0x8f2/0xad0 [ 3500.758710] ? tcp_check_oom+0x520/0x520 [ 3500.762759] ? kasan_check_read+0x11/0x20 [ 3500.766894] ? rcu_report_qs_rnp+0x761/0x790 [ 3500.771308] ? tls_write_space+0x340/0x340 [ 3500.775543] ? kasan_check_read+0x11/0x20 [ 3500.779682] ? rcu_is_watching+0x85/0x140 [ 3500.783821] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3500.789345] ? ipv6_sock_ac_close+0x34e/0x480 [ 3500.793829] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3500.799356] ? ipv6_sock_mc_close+0x161/0x1c0 [ 3500.803840] ? ip_mc_drop_socket+0x20f/0x270 [ 3500.808236] inet_release+0x104/0x1f0 [ 3500.812030] inet6_release+0x50/0x70 [ 3500.815734] sock_release+0x96/0x1b0 [ 3500.819436] ? sock_alloc_file+0x4e0/0x4e0 [ 3500.823658] sock_close+0x16/0x20 [ 3500.827095] __fput+0x353/0x890 [ 3500.830362] ? fput+0x1a0/0x1a0 [ 3500.833638] ? check_same_owner+0x320/0x320 [ 3500.837954] ? _raw_spin_unlock_irq+0x27/0x70 [ 3500.842438] ____fput+0x15/0x20 [ 3500.845717] task_work_run+0x1e4/0x290 [ 3500.849618] ? task_work_cancel+0x240/0x240 [ 3500.853932] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3500.859469] ? switch_task_namespaces+0xa2/0xd0 [ 3500.864129] do_exit+0x1aee/0x2730 [ 3500.867665] ? plist_add+0x770/0x770 [ 3500.871369] ? mm_update_next_owner+0x980/0x980 [ 3500.876029] ? print_usage_bug+0xc0/0xc0 [ 3500.880079] ? graph_lock+0x170/0x170 [ 3500.883874] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3500.888287] ? rcu_note_context_switch+0x710/0x710 [ 3500.893202] ? lock_acquire+0x1dc/0x520 [ 3500.897425] ? __might_sleep+0x95/0x190 [ 3500.901388] ? __lock_acquire+0x7f5/0x5140 [ 3500.905634] ? debug_check_no_locks_freed+0x310/0x310 [ 3500.910809] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3500.915227] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3500.920408] ? kasan_check_write+0x14/0x20 [ 3500.924904] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 3500.930112] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3500.935657] ? drop_futex_key_refs.isra.13+0x6d/0xe0 [ 3500.941037] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3500.946922] ? futex_wait+0x5c1/0x9f0 [ 3500.950715] ? futex_wait_setup+0x400/0x400 [ 3500.955035] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 3500.960307] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3500.965832] ? drop_futex_key_refs.isra.13+0x6d/0xe0 [ 3500.970923] ? futex_wake+0x2f6/0x750 [ 3500.974715] ? graph_lock+0x170/0x170 [ 3500.978503] ? find_held_lock+0x36/0x1c0 [ 3500.982645] ? memset+0x31/0x40 [ 3500.985917] ? find_held_lock+0x36/0x1c0 [ 3500.989973] ? lock_downgrade+0x8e0/0x8e0 [ 3500.994112] do_group_exit+0x16f/0x430 [ 3500.997988] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3501.002567] ? __ia32_sys_exit+0x50/0x50 [ 3501.006617] ? _raw_spin_unlock_irq+0x27/0x70 [ 3501.011116] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3501.016129] get_signal+0x886/0x1960 [ 3501.019843] ? ptrace_notify+0x130/0x130 [ 3501.023896] ? graph_lock+0x170/0x170 [ 3501.027688] ? mntput_no_expire+0x186/0xba0 [ 3501.032009] ? mnt_get_count+0x150/0x150 [ 3501.036062] ? find_held_lock+0x36/0x1c0 [ 3501.040113] do_signal+0x98/0x2040 [ 3501.043736] ? lock_downgrade+0x8e0/0x8e0 [ 3501.047871] ? setup_sigcontext+0x7d0/0x7d0 [ 3501.052179] ? kasan_check_read+0x11/0x20 [ 3501.056316] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.060827] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3501.065405] ? _raw_spin_unlock_irq+0x27/0x70 [ 3501.069896] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3501.074906] ? exit_to_usermode_loop+0x87/0x310 [ 3501.079567] exit_to_usermode_loop+0x28a/0x310 [ 3501.084136] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 3501.088967] ? do_syscall_64+0x92/0x800 [ 3501.092934] do_syscall_64+0x6ac/0x800 [ 3501.096822] ? finish_task_switch+0x1ca/0x840 [ 3501.101323] ? syscall_return_slowpath+0x5c0/0x5c0 [ 3501.106267] ? syscall_return_slowpath+0x30f/0x5c0 [ 3501.111198] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 3501.116554] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3501.122443] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3501.127624] RIP: 0033:0x4559f9 [ 3501.130899] Code: Bad RIP value. [ 3501.134446] RSP: 002b:00007fc449b56ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 3501.142228] RAX: fffffffffffffe00 RBX: 000000000072bec8 RCX: 00000000004559f9 [ 3501.149500] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000072bec8 [ 3501.156753] RBP: 000000000072bec8 R08: 0000000000000033 R09: 000000000072bea0 [ 3501.164284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3501.171547] R13: 0000000000a3e81f R14: 00007fc449b579c0 R15: 0000000000000000 [ 3501.178809] [ 3501.180421] The buggy address belongs to the page: [ 3501.185338] page:ffffea000711f400 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 [ 3501.193728] flags: 0x2fffc0000000000() [ 3501.197611] raw: 02fffc0000000000 ffffea000588a408 ffffea00060cba08 0000000000000000 [ 3501.205482] raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 [ 3501.213436] page dumped because: kasan: bad access detected [ 3501.219385] [ 3501.221002] Memory state around the buggy address: [ 3501.225920] ffff8801c47cff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3501.233272] ffff8801c47cff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3501.240617] >ffff8801c47d0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3501.247958] ^ [ 3501.251315] ffff8801c47d0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3501.258660] ffff8801c47d0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3501.265998] ================================================================== [ 3501.273339] Disabling lock debugging due to kernel taint [ 3501.278961] Kernel panic - not syncing: panic_on_warn set ... [ 3501.278961] [ 3501.286337] CPU: 1 PID: 16913 Comm: syz-executor2 Tainted: G B 4.17.0+ #91 [ 3501.295026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3501.304469] Call Trace: [ 3501.307077] dump_stack+0x1b9/0x294 [ 3501.310693] ? dump_stack_print_info.cold.2+0x52/0x52 [ 3501.316052] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 3501.320796] ? tls_push_record+0xfb0/0x13e0 [ 3501.325237] panic+0x22f/0x4de [ 3501.328424] ? add_taint.cold.5+0x16/0x16 [ 3501.332556] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.336949] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.341348] ? tls_push_record+0x1023/0x13e0 [ 3501.345828] kasan_end_report+0x47/0x4f [ 3501.349796] kasan_report.cold.7+0x76/0x2fe [ 3501.354104] __asan_report_store1_noabort+0x17/0x20 [ 3501.359103] tls_push_record+0x1023/0x13e0 [ 3501.363323] ? __local_bh_enable_ip+0x161/0x230 [ 3501.367984] tls_sw_push_pending_record+0x22/0x30 [ 3501.372811] tls_push_pending_closed_record+0x10c/0x150 [ 3501.378158] ? lock_sock_nested+0xe7/0x120 [ 3501.382386] tls_sk_proto_close+0x8f2/0xad0 [ 3501.386691] ? tcp_check_oom+0x520/0x520 [ 3501.390734] ? kasan_check_read+0x11/0x20 [ 3501.394878] ? rcu_report_qs_rnp+0x761/0x790 [ 3501.399282] ? tls_write_space+0x340/0x340 [ 3501.403509] ? kasan_check_read+0x11/0x20 [ 3501.407658] ? rcu_is_watching+0x85/0x140 [ 3501.411795] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3501.417321] ? ipv6_sock_ac_close+0x34e/0x480 [ 3501.421806] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3501.427342] ? ipv6_sock_mc_close+0x161/0x1c0 [ 3501.431826] ? ip_mc_drop_socket+0x20f/0x270 [ 3501.436225] inet_release+0x104/0x1f0 [ 3501.440018] inet6_release+0x50/0x70 [ 3501.443806] sock_release+0x96/0x1b0 [ 3501.447505] ? sock_alloc_file+0x4e0/0x4e0 [ 3501.451729] sock_close+0x16/0x20 [ 3501.455168] __fput+0x353/0x890 [ 3501.458434] ? fput+0x1a0/0x1a0 [ 3501.461698] ? check_same_owner+0x320/0x320 [ 3501.466008] ? _raw_spin_unlock_irq+0x27/0x70 [ 3501.470495] ____fput+0x15/0x20 [ 3501.473762] task_work_run+0x1e4/0x290 [ 3501.477648] ? task_work_cancel+0x240/0x240 [ 3501.481968] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3501.487502] ? switch_task_namespaces+0xa2/0xd0 [ 3501.492157] do_exit+0x1aee/0x2730 [ 3501.495692] ? plist_add+0x770/0x770 [ 3501.499419] ? mm_update_next_owner+0x980/0x980 [ 3501.504088] ? print_usage_bug+0xc0/0xc0 [ 3501.508143] ? graph_lock+0x170/0x170 [ 3501.511927] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.516319] ? rcu_note_context_switch+0x710/0x710 [ 3501.521320] ? lock_acquire+0x1dc/0x520 [ 3501.525286] ? __might_sleep+0x95/0x190 [ 3501.529263] ? __lock_acquire+0x7f5/0x5140 [ 3501.533493] ? debug_check_no_locks_freed+0x310/0x310 [ 3501.538699] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.543280] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3501.547934] ? kasan_check_write+0x14/0x20 [ 3501.552154] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 3501.557353] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3501.562897] ? drop_futex_key_refs.isra.13+0x6d/0xe0 [ 3501.568286] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3501.573816] ? futex_wait+0x5c1/0x9f0 [ 3501.577624] ? futex_wait_setup+0x400/0x400 [ 3501.581941] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 3501.587117] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 3501.592641] ? drop_futex_key_refs.isra.13+0x6d/0xe0 [ 3501.597730] ? futex_wake+0x2f6/0x750 [ 3501.601514] ? graph_lock+0x170/0x170 [ 3501.605303] ? find_held_lock+0x36/0x1c0 [ 3501.609347] ? memset+0x31/0x40 [ 3501.612610] ? find_held_lock+0x36/0x1c0 [ 3501.616665] ? lock_downgrade+0x8e0/0x8e0 [ 3501.620805] do_group_exit+0x16f/0x430 [ 3501.624685] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3501.629251] ? __ia32_sys_exit+0x50/0x50 [ 3501.633296] ? _raw_spin_unlock_irq+0x27/0x70 [ 3501.637786] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3501.642791] get_signal+0x886/0x1960 [ 3501.646497] ? ptrace_notify+0x130/0x130 [ 3501.650561] ? graph_lock+0x170/0x170 [ 3501.654350] ? mntput_no_expire+0x186/0xba0 [ 3501.658653] ? mnt_get_count+0x150/0x150 [ 3501.662701] ? find_held_lock+0x36/0x1c0 [ 3501.666783] do_signal+0x98/0x2040 [ 3501.670309] ? lock_downgrade+0x8e0/0x8e0 [ 3501.674443] ? setup_sigcontext+0x7d0/0x7d0 [ 3501.678837] ? kasan_check_read+0x11/0x20 [ 3501.683074] ? do_raw_spin_unlock+0x9e/0x2e0 [ 3501.687572] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 3501.692138] ? _raw_spin_unlock_irq+0x27/0x70 [ 3501.696621] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 3501.701624] ? exit_to_usermode_loop+0x87/0x310 [ 3501.706286] exit_to_usermode_loop+0x28a/0x310 [ 3501.710854] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 3501.715689] ? do_syscall_64+0x92/0x800 [ 3501.719652] do_syscall_64+0x6ac/0x800 [ 3501.723529] ? finish_task_switch+0x1ca/0x840 [ 3501.728011] ? syscall_return_slowpath+0x5c0/0x5c0 [ 3501.732936] ? syscall_return_slowpath+0x30f/0x5c0 [ 3501.737851] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 3501.743217] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3501.748047] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3501.753236] RIP: 0033:0x4559f9 [ 3501.756411] Code: Bad RIP value. [ 3501.759779] RSP: 002b:00007fc449b56ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 3501.767477] RAX: fffffffffffffe00 RBX: 000000000072bec8 RCX: 00000000004559f9 [ 3501.774743] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000072bec8 [ 3501.781996] RBP: 000000000072bec8 R08: 0000000000000033 R09: 000000000072bea0 [ 3501.789253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3501.796513] R13: 0000000000a3e81f R14: 00007fc449b579c0 R15: 0000000000000000 [ 3501.803807] Dumping ftrace buffer: [ 3501.807325] (ftrace buffer empty) [ 3501.811023] Kernel Offset: disabled [ 3501.814628] Rebooting in 86400 seconds..