) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x300000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) lseek(r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000032c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000003300)) 02:03:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x5, 0x0, &(0x7f0000000300)}) 02:03:18 executing program 2 (fault-call:4 fault-nth:4): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1693.504479][ T5] binder_release_work: 2 callbacks suppressed [ 1693.504485][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1693.524311][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1693.530094][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x400000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1693.654751][T17105] binder: 17099:17105 transaction failed 29201/-22, size 0-4 line 3201 [ 1693.705587][T17105] binder: 17099:17105 transaction failed 29201/-22, size 0-4 line 3201 [ 1693.734475][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1693.750403][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x500000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6, 0x0, &(0x7f0000000300)}) 02:03:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x3, 0x2) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x4020565a, &(0x7f0000000080)={0x2, 0x40, 0x3}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) 02:03:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1693.855967][T17120] binder: 17119:17120 transaction failed 29201/-22, size 0-4 line 3201 [ 1693.894472][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:19 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x578200000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7, 0x0, &(0x7f0000000300)}) 02:03:19 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) write$FUSE_OPEN(r3, &(0x7f0000000080)={0x20, 0x0, 0x7, {0x0, 0x4}}, 0x20) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x28000, 0x0) ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000003000000", @ANYRES32=r3, @ANYBLOB="0000000000f0ffffffffffff0090000000000000", @ANYRES32=r3, @ANYBLOB="00000000000000000100000000f0ffff01000000", @ANYRES32=r4, @ANYBLOB="dfff0000001d000000000100000000f0ffffffffbdf58c184892a2791cdbe570c90bff8848ba4e20625e9abee5d6b637a821642c3dd32c5620a98f1c3ccfac84f5453f3e1490f00b835277510cec7f9a2d925db658bfae16f44c6017e11904000000"]) close(r0) 02:03:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1694.293364][T17138] binder: 17135:17138 transaction failed 29201/-22, size 0-4 line 3201 [ 1694.325837][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x8, 0x0, &(0x7f0000000300)}) [ 1694.371080][T17144] serio: Serial port pts3 02:03:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x600000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:19 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:19 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x450) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044326, &(0x7f0000000080)=0x81) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) fdatasync(r1) close(r0) [ 1694.464041][T17151] binder: 17150:17151 transaction failed 29201/-22, size 0-4 line 3201 02:03:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x2f}], 0x1) dup2(r1, r0) [ 1694.511854][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa, 0x0, &(0x7f0000000300)}) [ 1694.676248][T17164] binder_transaction: 6 callbacks suppressed [ 1694.676260][T17164] binder: 17163:17164 got transaction with invalid offsets size, 4 [ 1694.685985][T17164] binder: 17163:17164 transaction failed 29201/-22, size 0-4 line 3201 [ 1694.706585][T17162] serio: Serial port pts3 [ 1694.740317][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:19 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x800000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:19 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x200) ioctl$VIDIOC_G_PRIORITY(r3, 0x80045643, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x12, 0x0, &(0x7f0000000300)}) 02:03:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x3d0}], 0x1) dup2(r1, r0) 02:03:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x806000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1695.295731][T17172] binder: 17171:17172 got transaction with invalid offsets size, 4 [ 1695.303808][T17172] binder: 17171:17172 transaction failed 29201/-22, size 0-4 line 3201 [ 1695.334678][T17178] serio: Serial port pts3 02:03:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vga_arbiter\x00', 0x400000, 0x0) connect$vsock_stream(r3, &(0x7f0000001300)={0x28, 0x0, 0xffffffff}, 0x10) close(r0) 02:03:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0xd00000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x200000d5}], 0x1) dup2(r1, r0) [ 1695.404010][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x48, 0x0, &(0x7f0000000300)}) [ 1695.569166][T17195] serio: Serial port pts3 [ 1695.579857][T17196] binder: 17193:17196 got transaction with invalid offsets size, 4 [ 1695.637420][T17196] binder: 17193:17196 transaction failed 29201/-22, size 0-4 line 3201 02:03:20 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x2800000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x7ffff000}], 0x1) dup2(r1, r0) 02:03:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x4, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x2, 0x400) ioctl$PPPOEIOCSFWD(r3, 0x4008b100, &(0x7f00000000c0)={0x18, 0x0, {0x1, @random="c65b425476a6", 'batadv0\x00'}}) close(r0) [ 1695.684608][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4c, 0x0, &(0x7f0000000300)}) [ 1695.780015][T17208] serio: Serial port pts3 02:03:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x2900000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x2) dup2(r1, r0) [ 1695.879204][T17217] binder: 17215:17217 got transaction with invalid offsets size, 4 [ 1695.952742][T17225] binder: 17215:17225 got transaction with invalid offsets size, 4 [ 1695.952915][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = shmget(0x2, 0x7000, 0x78001b40, &(0x7f0000ff9000/0x7000)=nil) shmctl$IPC_RMID(r3, 0x0) 02:03:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x2b00000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1696.000849][T17226] serio: Serial port pts3 02:03:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:21 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x60, 0x0, &(0x7f0000000300)}) 02:03:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x4) dup2(r1, r0) 02:03:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x2c00000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:21 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:21 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x5, 0x200) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) r2 = socket$inet(0x2, 0x0, 0x10000) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) select(0x40, &(0x7f00000002c0)={0x5, 0x3ff, 0x4, 0x0, 0x4, 0x8, 0x9, 0x1}, &(0x7f0000000340)={0x100000000, 0x51f03669, 0x4, 0x9, 0xff, 0x401, 0x5, 0x400}, &(0x7f0000000380)={0x1, 0x2, 0x1, 0xdf, 0x1000, 0x4, 0x8, 0x1}, &(0x7f00000003c0)) listen(r0, 0xff) r3 = socket$inet6_sctp(0xa, 0xffffffffffffffff, 0x84) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000300)='/dev/qat_adf_ctl\x00', 0x2002, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000140)={0x81}, 0x1) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x9, @local, 0x3131}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000240)={'IDLETIMER\x00'}, &(0x7f0000000280)=0x1e) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000080)=""/165) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)=0x80) sendto(r3, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r1) [ 1696.666408][T17246] binder: 17240:17246 got transaction with invalid offsets size, 4 [ 1696.716850][T17251] serio: Serial port pts3 02:03:21 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x2f00000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:21 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x68, 0x0, &(0x7f0000000300)}) 02:03:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x7) dup2(r1, r0) 02:03:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x3578200000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1696.893110][T17265] binder: 17261:17265 got transaction with invalid offsets size, 4 02:03:22 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6c, 0x0, &(0x7f0000000300)}) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x3c00000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x8) dup2(r1, r0) 02:03:22 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000080)=0x4) r2 = getpid() wait4(r2, &(0x7f00000000c0), 0x40000001, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x4000000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1697.398846][T17281] binder: 17279:17281 got transaction with invalid offsets size, 4 02:03:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x9) dup2(r1, r0) 02:03:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x74, 0x0, &(0x7f0000000300)}) 02:03:22 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0xffffffffffffff06) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='reno\x00', 0x5) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x4305000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1697.610772][T17297] binder: 17295:17297 got transaction with invalid offsets size, 4 02:03:22 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xf) dup2(r1, r0) 02:03:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7a, 0x0, &(0x7f0000000300)}) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x6000000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:22 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x4000000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7, 0x800) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000080)=0x1000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8000000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1697.936321][T17317] binder: 17312:17317 got transaction with invalid offsets size, 4 02:03:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x1a0, 0x0, &(0x7f0000000300)}) 02:03:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x25) dup2(r1, r0) 02:03:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x800e000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1698.117348][T17331] binder_transaction: 7 callbacks suppressed [ 1698.117363][T17331] binder: 17327:17331 transaction failed 29201/-22, size 0-4 line 3201 02:03:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1698.164237][ C0] net_ratelimit: 24 callbacks suppressed [ 1698.164245][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1698.175974][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:23 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x18f) close(r0) 02:03:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8035000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x300, 0x0, &(0x7f0000000300)}) 02:03:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x2f) dup2(r1, r0) 02:03:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8100000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1698.753101][T17352] binder: 17347:17352 transaction failed 29201/-22, size 0-4 line 3201 02:03:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x500, 0x0, &(0x7f0000000300)}) 02:03:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x63) dup2(r1, r0) 02:03:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x86ddffff00000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1698.937715][T17370] binder: 17367:17370 transaction failed 29201/-22, size 0-4 line 3201 [ 1698.995158][T17370] binder: 17367:17370 transaction failed 29201/-22, size 0-4 line 3201 02:03:23 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x37e) dup2(r1, r0) 02:03:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8847000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:23 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80, 0x0) getsockname$llc(r0, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000000c0)=0x10) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r1) 02:03:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x600, 0x0, &(0x7f0000000300)}) 02:03:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1699.189174][T17389] binder: 17385:17389 transaction failed 29201/-22, size 0-4 line 3201 [ 1699.204250][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1699.210023][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1699.215863][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1699.221619][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8848000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x700, 0x0, &(0x7f0000000300)}) 02:03:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x394) dup2(r1, r0) 02:03:24 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x80000, 0x0) recvfrom$llc(r3, &(0x7f0000000540)=""/161, 0xa1, 0x0, &(0x7f0000000600)={0x1a, 0xfffe, 0xa1, 0x401, 0xa6, 0x8, @random="85b3c0be4d6e"}, 0x10) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1699.369930][T17405] binder: 17404:17405 transaction failed 29201/-22, size 0-4 line 3201 [ 1699.426688][T17408] binder: 17404:17408 transaction failed 29201/-22, size 0-4 line 3201 [ 1699.524275][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1699.530336][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1699.536199][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1699.542045][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:03:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x3b7) dup2(r1, r0) 02:03:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8864000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:24 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa00, 0x0, &(0x7f0000000300)}) 02:03:24 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x20800, 0x0) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x0, 0x5}}, 0x30) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e24, 0x2, @empty, 0x2000000}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:03:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x88a8ffff00000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1699.708791][T17425] binder_transaction: 7 callbacks suppressed [ 1699.708802][T17425] binder: 17421:17425 got transaction with invalid offsets size, 4 [ 1699.747043][T17425] binder: 17421:17425 transaction failed 29201/-22, size 0-4 line 3201 02:03:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x7ffffff2) dup2(r1, r0) 02:03:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x1200, 0x0, &(0x7f0000000300)}) 02:03:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2) 02:03:24 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'bpq0\x00', {0x2, 0x4e20, @loopback}}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x88caffff00000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1699.969180][T17445] binder: 17443:17445 got transaction with invalid offsets size, 4 02:03:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x7ffffff8) dup2(r1, r0) [ 1700.023322][T17445] binder: 17443:17445 transaction failed 29201/-22, size 0-4 line 3201 02:03:25 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3) 02:03:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x8906000000000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x2000, 0x0, &(0x7f0000000300)}) 02:03:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x7ffffff9) dup2(r1, r0) 02:03:25 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xc165) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x89ffffff00000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1700.621358][T17466] binder: 17461:17466 got transaction with invalid offsets size, 4 02:03:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4) [ 1700.702599][T17466] binder: 17461:17466 transaction failed 29201/-22, size 0-4 line 3201 02:03:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff8880932202d8) dup2(r1, r0) 02:03:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0xffffffff00000000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x5) 02:03:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4800, 0x0, &(0x7f0000000300)}) [ 1700.953261][T17491] binder: 17488:17491 got transaction with invalid offsets size, 4 02:03:25 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:25 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x4, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x1, r3, 0x3c, 0x0, @in6={0xa, 0x4e24, 0xc746, @mcast1, 0x9}}}, 0xa0) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0xfffffffffffff000, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb93b8) dup2(r1, r0) 02:03:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x6) 02:03:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4c00, 0x0, &(0x7f0000000300)}) [ 1701.117739][T17502] binder: 17501:17502 got transaction with invalid offsets size, 4 02:03:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb9578) dup2(r1, r0) 02:03:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x7) 02:03:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6000, 0x0, &(0x7f0000000300)}) 02:03:26 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x101000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, r2, 0x920, 0x70bd2a, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x5, @media='ib\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x4000010) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0xc8, r3, 0x900, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x6c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff7fffffff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}]}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) r4 = socket$inet6_sctp(0xa, 0xfffffffffffffffe, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendto(r4, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) times(&(0x7f0000000440)) 02:03:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1701.358480][T17521] binder: 17519:17521 got transaction with invalid offsets size, 4 02:03:26 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x8) 02:03:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb9738) dup2(r1, r0) 02:03:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6800, 0x0, &(0x7f0000000300)}) 02:03:26 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1701.796041][T17538] binder: 17535:17538 got transaction with invalid offsets size, 4 02:03:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x9) 02:03:26 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x800000000001) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000080)=""/144, &(0x7f0000000000)=0x90) r1 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x4, 0x2) write$FUSE_BMAP(r1, &(0x7f00000001c0)={0x18, 0x0, 0x2, {0x5f2b462f}}, 0x18) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet6_dccp_int(r0, 0x21, 0xa, &(0x7f0000000200), &(0x7f0000000240)=0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r3) 02:03:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x5, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1701.845435][T17538] binder: 17535:17538 got transaction with invalid offsets size, 4 02:03:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb99d8) dup2(r1, r0) 02:03:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6c00, 0x0, &(0x7f0000000300)}) 02:03:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xa) [ 1702.074597][T17562] binder: 17561:17562 got transaction with invalid offsets size, 4 02:03:27 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x6, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb9e38) dup2(r1, r0) 02:03:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7400, 0x0, &(0x7f0000000300)}) 02:03:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xb) 02:03:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x1) close(r0) r3 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f00000000c0)=0x7, 0x4) 02:03:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xc) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1702.471402][T17578] binder: 17574:17578 got transaction with invalid offsets size, 4 02:03:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7a00, 0x0, &(0x7f0000000300)}) 02:03:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0xffff888095fb9f18) dup2(r1, r0) 02:03:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xd, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:27 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe) 02:03:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x1000000, 0x0, &(0x7f0000000300)}) 02:03:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) truncate(&(0x7f0000000000)='./file0\x00', 0xb763) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) connect$caif(r2, &(0x7f0000000040)=@dgm={0x25, 0x1, 0x8}, 0x18) 02:03:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x56, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @local, [], {@generic={0x88e7, "79c0395043e82523487bba0413e34344ebd0914ff10ae2a6de59d5ff6b8989bfd365689e2ffedad1d459aa091166968b88953d72443165c612de25d6a5b0b898dd53cae89125f320"}}}, &(0x7f00000002c0)={0x0, 0x2, [0xc6b, 0x8dd, 0x737, 0x298]}) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000300)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f00000004c0)={0x4, 0x0, [{0x101, 0x3, 0x0, 0x0, @irqchip={0x4, 0x101}}, {0x6, 0x1, 0x0, 0x0, @irqchip={0x6, 0x6}}, {0xffffffff, 0x1, 0x0, 0x0, @adapter={0x7fffffff, 0x1ff, 0x0, 0x6, 0x3}}, {0x4, 0x3, 0x0, 0x0, @sint={0x20, 0xfffffffffffffffc}}]}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400000, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r5, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000700)=ANY=[@ANYBLOB="c00005004275fbdc9022a5d52a00003a0570c7107b9cbad1009ff6cfbda5fc91a2a1969d0ef6f5621cfad673a0e2550ae1242c5c679117f9081eb44077d781005312d6eec31f5bab93a8f31372396e52ecfe27bdb9817e16c752b02f5be4f47920f1eff380f4221c1c063f88546dde20cca36a3524457809b90500000000000000c6a0cd02a04639d50b446aab0ed9466c551f8721a2828690bbb54309e5d8b5c31a0542db427b87bf749f57b4b803d80a1c451c422471af3328c3ad12ea8c3668157a0700000000000000818994b9009c16bb9fbed806000032a95d33fe6be864302992f7ee16e8d7b8939b4ed5d5367fbf5769d1cc102ba1cb6fe94b73241f67c79fbf3c3b7053dbfe15812daa60daa8bdd3391c27e43cfc645fd7f97b4315cda6ea5a0d54af78a6f7108324b67225d19f19a12fa8a8c4d74cd8df5edba06f2adcbd54739f18f7619130c05b3ef2436a6642d070287e87fa0f38181d8a3302d78963a167d906f073801c30c953895c1db7", @ANYRES16=r6, @ANYBLOB="08002dbd7000fbdbdf250700000014000100080001000a00000008000200770000000c00020008000800010100005000010008000900430000000800020000000000080001000a0000001400030000000000000000000000ffff0000000008000b0073697000080004004e2000000800050000000000080009006800000008000500400000003400010008000100000000000800010002000000080002003b000000080001000200000008000b00736970000800090072000000"], 0xc0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) sendmsg$IPVS_CMD_GET_DAEMON(r5, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010026bd7000fedbdf250b000000080005001c000000080006004000000038000324d402e7eab2caf1ff08000800f7000000080007004e200000080004000080c9413b0a00001400060000000000000000000000000000000001"], 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x20008010) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$bt_rfcomm(0x1f, 0xffffffffffffffff, 0x3) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) syz_emit_ethernet(0xffb6, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1=0xe000039b}, @udp={0x0, 0x0, 0xffffca88}}}}}, 0x0) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f00000001c0)={[{0x3, 0x7, 0x10000, 0x4, 0x7, 0x7, 0xd7e, 0x9, 0x0, 0x401, 0x76, 0x7ff, 0x1}, {0x1, 0x3, 0xe2c7, 0x3ff, 0x100000000, 0x6, 0x9, 0x80, 0x0, 0xffffffff00000000, 0x8001, 0x1, 0xffffffff}, {0x5, 0x1000, 0x3, 0x2, 0x3, 0x2, 0x194, 0x80, 0x4, 0x200, 0x0, 0x1, 0x100000001}], 0x10001}) close(r0) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x28, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x29, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1702.944675][T17610] serio: Serial port pts3 02:03:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x2000000, 0x0, &(0x7f0000000300)}) 02:03:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf) 02:03:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000000000)) 02:03:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) getsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) sched_getparam(r4, &(0x7f0000000080)) 02:03:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2b, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1703.170306][T17630] serio: Serial port pts3 [ 1703.364591][ C0] net_ratelimit: 16 callbacks suppressed [ 1703.364600][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1703.376773][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1703.383374][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1703.389400][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:28 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x3000000, 0x0, &(0x7f0000000300)}) 02:03:28 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x10) 02:03:28 executing program 2: r0 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x60) write(r0, &(0x7f0000000180)="0f8225044f034afb53ab98f694dce5513fcc7c", 0x13) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x4400, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f00000001c0)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x200, 0x60681) mincore(&(0x7f0000fff000/0x1000)=nil, 0x1000, &(0x7f0000000280)=""/30) bind$x25(r3, &(0x7f0000000240)={0x9, @remote={[], 0x2}}, 0x12) dup2(r0, r0) 02:03:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2c, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:28 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x37, &(0x7f00000001c0)=""/199, &(0x7f00000002c0)=0xc7) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000080)=""/217, &(0x7f0000000000)=0xd9) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/rtc0\x00', 0x10000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000a40)=[@in6={0xa, 0x4e23, 0xffffffffffff834a, @empty, 0x2}, @in={0x2, 0x4e22, @local}], 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000380)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5f0, 0x330, 0x440, 0x0, 0xf8, 0x330, 0x558, 0x558, 0x558, 0x558, 0x558, 0x6, &(0x7f0000000300), {[{{@uncond, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x20, 0x6000, 0x9, 0x101, 0x0, 0x9], 0x800, 0x8d0a}, {0xffffffffffff8001, [0x214, 0x4d0, 0x9, 0x8, 0x10000, 0x10000], 0x7f, 0x100}}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x9, 0x4, 0x2, 0x1}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x3687}}}, {{@uncond, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0xffffffffffffffc4, 0x3, 0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x6}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x5, 0x0, 0x12}, {0x2, 0x2, 0x7ff}, {0x3ff, 0x5, 0x5}, 0x1358017b, 0x8}}}, {{@ip={@empty, @dev={0xac, 0x14, 0x14, 0x28}, 0xff000000, 0xffffffff, 'ip6gre0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0xff, 0x2, 0x1}, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x81, 0x8}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x1, 0x2, 0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x650) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:28 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x11) 02:03:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2f, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1703.659173][T17651] binder_transaction: 11 callbacks suppressed [ 1703.659189][T17651] binder: 17648:17651 transaction failed 29201/-22, size 0-4 line 3201 [ 1703.684215][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1703.690064][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1703.695931][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1703.701679][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:03:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1703.781167][T17661] binder: 17648:17661 transaction failed 29201/-22, size 0-4 line 3201 02:03:28 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x24800, 0x0) ioctl$SIOCGETNODEID(r3, 0x89e1, &(0x7f0000000080)={0x2}) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3c, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4000000, 0x0, &(0x7f0000000300)}) [ 1703.916652][T17666] serio: Serial port pts3 [ 1703.925050][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1703.931078][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1703.991476][T17674] binder: 17673:17674 transaction failed 29201/-22, size 0-4 line 3201 02:03:29 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x14) 02:03:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(0xffffffffffffffff, &(0x7f0000000100), 0x0) dup2(0xffffffffffffffff, r0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x6) 02:03:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x60, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x5000000, 0x0, &(0x7f0000000300)}) 02:03:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) syz_extract_tcp_res(&(0x7f0000000140), 0x400, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x402, 0x0) perf_event_open(&(0x7f0000000080)={0x2412294c85f1724, 0x70, 0x0, 0x8001, 0x100000000, 0x7f, 0x0, 0x23, 0x240, 0x5, 0x4, 0x2b, 0x10001, 0x4, 0x80d, 0x1, 0xfe8d, 0xfffffffffffffff9, 0x1f8b, 0x6, 0x9, 0x1, 0x4, 0x800, 0x1, 0x8, 0xef5b, 0xffffffff0000, 0x7, 0xb3, 0x4, 0x9, 0x1, 0x5, 0x46, 0x2, 0x4, 0x1, 0x0, 0x555c, 0x5, @perf_config_ext={0x3ff, 0xf800000000000000}, 0x20000, 0x1, 0x3f, 0xf, 0x3, 0x6174, 0x5}, r1, 0xb, r2, 0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r3, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xf0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x18) [ 1704.464721][T17689] binder: 17680:17689 transaction failed 29201/-22, size 0-4 line 3201 02:03:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) lsetxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.origin\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) sync_file_range(r2, 0x0, 0x9, 0x3) [ 1704.520772][T17689] binder: 17680:17689 transaction failed 29201/-22, size 0-4 line 3201 02:03:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4800) getpeername$netlink(r1, &(0x7f0000000080), &(0x7f00000000c0)=0xc) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x6111}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f00000001c0)={r4, 0x43, 0x44}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6000000, 0x0, &(0x7f0000000300)}) 02:03:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x300, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1704.679469][T17703] serio: Serial port pts3 [ 1704.762643][T17709] binder_transaction: 9 callbacks suppressed [ 1704.762653][T17709] binder: 17708:17709 got transaction with invalid offsets size, 4 [ 1704.853824][T17709] binder: 17708:17709 transaction failed 29201/-22, size 0-4 line 3201 [ 1704.903961][T17713] binder: 17708:17713 got transaction with invalid offsets size, 4 [ 1704.938218][T17713] binder: 17708:17713 transaction failed 29201/-22, size 0-4 line 3201 02:03:29 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x24) 02:03:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x500, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x40002, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:29 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40, 0x0) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000080)=0x80, 0x4) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7000000, 0x0, &(0x7f0000000300)}) [ 1705.234269][T17721] serio: Serial port pts3 [ 1705.247682][T17725] binder: 17716:17725 got transaction with invalid offsets size, 4 02:03:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x543, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:30 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x30) 02:03:30 executing program 2: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x22202, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x1292c2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1705.322836][T17725] binder: 17716:17725 transaction failed 29201/-22, size 0-4 line 3201 02:03:30 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0xfdcf) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x600, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1705.449813][T17740] serio: Serial port pts8 02:03:30 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x44) 02:03:30 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9b06000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x8000000, 0x0, &(0x7f0000000300)}) 02:03:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x608, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:30 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) arch_prctl$ARCH_GET_CPUID(0x1011) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) lookup_dcookie(0x6fd, &(0x7f00000000c0)=""/4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x80000000, 0x80000) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000080)) 02:03:30 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r2, r1) io_setup(0x7, &(0x7f0000000080)=0x0) io_cancel(r4, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x6, 0x4, r3, &(0x7f0000000180)="3ac2c1f892653460d3a9933699d9f8c42a8f1f67b88b3e9febceb71662ded316027be79c1844ecdd8951beb6c02e5d98b2511e18d9a9ca96e4396625a19d5fd0ae872ee4ba5a51d1f4f2f104cfe91680ff5b8147f57301e1cd4eae022046e63b4308215ce7f37eeada98491a43562cc06493762b693faf8a905b2055f8ae6d20d7ffbca5824d532d31db2fd20ff1d3fbfe6243ca030b760bbbbd120d4c5645adb1e59eccafa8d18512e4a3e57e95fb0d2d8b6f5a0dddac21c1d9f4e5e9486ea0b57189dba0437ad251699ae9702285c1c867c049e3e434d6be9e7d0910be335817d405377fcf23e84af85db34f6b66f38a32f024bb4e759b6d74cb6820b4d85896045d6032e1d80b70249f9a7b1904f01c1f1301c40ffa94809277faae26645ebf96616a6269f9e4a463de250a94abd06050a2a842905c2d43070fab9b59c54fe7eabd0e7858c21dc9b9770bfe0c68b19638964fc5409a088af06176efc1db859d24fcfb817612a7fff2f53c3658c67363c7380b0c27112f37175376e4ade9486f446af0aef7c66619632fbde05a59c92595b312c6682d7e1e70285914ecb2a5d81a3434894140e3f36bcd435ce94c4df507cdf7bf47bee36461cab17102ae18bc470ad1329e987c6d41a0a9350f3d119d9bd6e2770ff3411493c3a2d2925a1bd6fc19451c58af3b4ccff2febd666c5e8f3b4af1fb4a4d909e7342b75430c0011129dcf3a6115062054ea53f93aa6a1b7e6e13ebf69b38d85239857518e53fca9933d9304376e55ba82eed713c47274a4e46bff10f4b9e37c067e3eda2c0f74535d3779cd4be39b016c9445d4efc77b999389a7ae334c69bc11088f8195a4ba373573029b4faa06eb21d26fa4fe8850615bd8cb586c016fe75b609581b096fc8ef4b645150f9049a80f6cd13a441459b9a8e5c439a798daaa07f88d05b402b075154796e6d173a21710f74f8422a6cb200596229a78b220d31a16dee8a43258f551764b4eb3d32997bad7b0d089ec212ab32737310e22829d78e979957a23014115a40582fcb3d251c4466d294a58e597e19c61c5092646af85fdc3f5503131d442d07fa99cdd060754158c04c503ded8d8183ead15332123bfa338f88014a1f8d0749b42e716e8a42ed23f6979ea708325a7dbd14784ca3fa2537fe30709f3e1e537d3ec03333e82f1d1a325909b3817726f833ea4959a625e132651227540ebef799cd5bbb4036bf60ab03111e4a67c38759f538af8e21012918d521b347459d7627ef1e80a5ba6153dc13ecc6dad01892f4a7e1ac2748a290a1696d6a902d86589cd59c5c975664178a86dcc3f1c13fe7a33fae0820c411d28564b91eb00ad6fc55e3a0ba32210027dea34750b788578e2370dbfd6d69b0cf235fbaf1e732571622226bd748418c064b77f4b16c56a9c46d07c15c4a5b95459e7abf464a6673b24d505d907557d6c6a23928a15009251124c64257b034c13ff3cac2fa68fa359853b6886acfa053dba3689fc513e8ba64eac0c322b2821e058ff589f2ba7d044b9f9915c3b39873ed24f5649cce2e79694478890ec3d25b71d46f62190bc5aa54199e453bab5ff4cb21c5107c43d37cd1e290689494927045d6c4e951e8e49b9db79c6c1e0b3750ef9a541c49fd958b5d67373abcb7652244417fd3e30b0fa4902fc8651a5d3e11e7edf065e5232a6521d2800962f85867ec0fa3e0286765197010583a4e76d2e238cdd44d3f25c6c763b2dca4b6b8a8d80a7ff9adb619a6d4bce0746ae098ed607de3c8a1008d82c0b45abd9bf882e8c015d7a6b71fb8bdaa2332da1ffc7ebb6a0a3de1a52bf84bc0d5dcf4db809ea7f944b42d7c4d31a52189c5100474f02ce23c4dfc69850d142ca90c6498b193a62eea75fb0bcfd92443fbbd198b0048cfc785d8239b174b3896cb67f02b7a2eacf74f2c79f878ba135c8163de455a6e3914b43221bfa00798462e3febf2774de759285aa9c75b9cd1dac5851101d71ed680943b6d6391591a3e185acc14b8c2055d87edcbc4bc871ce9089b286a6ea5e7833d769a89876483359cc41912bfc18220444d0017baf3e221ffee2e3b4999b7b912f021c22b902aec72664907c87078fbfa0def889484c33cef53d05c497119fbb51d6cc088873239c863c12091283a7d01e75033322d14da5d89f719334fe6ff4b9bb46aa9e1f8a54d63e1e33fc1908def6ff7005635cf4715b97caf0ea29ecfd7e8fb7e33d6893444faa10d72dea0fb069c07ed50b7652a4fcb773be0f220ad7a6269ac772583e9b0027e76d55bde1465ff976ae57ebfebe41bc580a1d105729a89551b4881e0258148a636f68e2f79077ff51b279a3d3199e4c855c118a1c2fc90fa6fda435635c5864934b4593ddc108ac4601d0e5e66deb1708fc85135f2817c526793eb00862e8025362e40015958acd9b4944c0fd84f3a0955be1eb54e41095d7d5b8d6fb3048f57c2cfdc0afc8fd6d972aa0f2bc7a40fd2671200c067964f293886290f20a4268d8c14af935d3d35f14fcc982bc36891c9dc7ecf3a226bf14c35575c9335acdd9359118bb6d20fef7cdcd10efa69b5a69d2f5a11a3c85bc4bc37251cfd33f9f15e3267b67aa84fd195b297daab4614b86481a55f3f1edece3e087bd37819850c6770bdc9b335842119896435cfa61c8b217bf491c6e95246a5c362303e95c7d9f7451e49ca4927c705a34deea269eb914d1a2622716cc603e87a293bc7e63dfe7c79e968468c38f79cc948ff8651f2de12497d8320c2b43325dbac55a529cdceddeabe7448841ffb75cb21a74782ea0cc67fa46854b58b796b79bb2c933d173b2d81a2a577dea9ebd1b8192c68353816912ee1a55d9e38fd3a6bccc54e432270238b29185d48556113e5bfa31318bccd91fc31fb32d1d4d7be78b450cdc78781a3889e01ef7e6f6c090729397d9223da19ddf3c945c9c330b1a76cfcfb6dcfffad66a0d20d9dd54b4d51bbe959ed86ca4ea7a481b230c6bb921d3ac91373a9d6d9f6aae0dc40052f0270358fadd6a37c269abfa4c9ffd1388bc36a5cda1d0afd6e603c851eb6594a46fbf93278534f438805e7bd19a23223453979d622e7648c9ebff9c71d7709cef139328e6616b1b5395d6c0916c1eea2a313efcbe837547155e8a55b9886c24c9e0b596b418a44934f7fbcc4e6e20e7416bd4c01ccc8ca9042bc0ed4e15c3480959314f85e2d21e090ee994467736ea35aabfb6f612dbb814a45881f826d28fc5d57792a2b2cf59300ecdc5f0adfc4a8c9a7d0c0294198e103c03c33548a7dad8c52c5c3281d0291d761a6544f3188cce9649498ec82227b9de9bafdc6d4a09da35bb797c39f7ca266c0666039a4ecff83d37bcb09fd141456625637dfef65b70a5fb5668c7b0573b358c5e5024832526559ccc9c559b436d538267577d8ee4d155dd165c590c3a72dc872df4e7a7a15816c17f7657245ad76efbb62666873c7d6dc13251d37a0c80d431e38e6fc4647d66d0caaa8eb231925f727203f9ae2082b0848be7204c275ec4a796b45ebcc6710003c980108633bd86ec9860d0eaa131764abef6bb75917aa69df7f41a75f1dfbbecedbdf9b2b9e5a7a57e0d0a06b0b6ca2aa82c1540ccdcbc8c9a8e136a14dd809ad1f54f9fbd37dbf6025e429da3a73ea4e1743134e5f61a82890e8e004e827477f58014058301279061e32f81c59840391fccd2598b3a97f8f179bfed1da086f2106dbe610a02e90d9c4a88e0600e443768ee3c5caa510885d8908b3c72330bfaf832d14fda8fb5159b56471b43c598e934a5be934cd14c8026b3e3a08a0f58159ccd2958f710ecd9b807d24c5c7663d5570e4ec3c93541a706e932c2406e510a62799c60e7abeb823fb79eb2c48b70cfdb9814b674ab3e49cf01f10d36ecb966423dc7d0231d629cf98219e3512630933b4eb514ceb41c02ce2283f31f04d913bced7cf43f7d7a430fcf64a7551562d4d35f2905164fcc6836da1bf420e1f5c6e93b915c661b57024622ea3833f593275eea9998c4a5239834707f29ef1f7c0ec1adf0da3901c6f7c09ed1d609a7c3b40dd862321e91eabbe6e92a19b76058072f32a89a7e3f9319e1185c4fa2e31819a4c32d079118c0aefe3a36d36cfa7b504a0cf7ca7ce664dbbb21386615376f683d8a130a5d409a2a6a8e6ec3e9ea0ee2780cc7d64d2b7cec6c83fded7abfcad191d6c4f38f632742ed4256a23499be1095e6ef80193f5ab524f5df8e42f659b7633a29e3ac1d2849d2644ab3e91a284d5c21335823d82da5a13c80e5ee8cb9dfc2ab39f242ffa49091e129cb4b77e7b00992731fec2dbfd22924b9c0708cc60b658067898513bf5dc16f93c924cbe63d8f52016a9765c23e7c30883c86e16681be1987c8bb3ac2fdc694dfb0b934095ca77f70dd565b91bc09156b206b656a2af58d139254efafbefbeb14d3a5c584a171f79b1c27b63768c8e0efdac0818b0033447375673abc3da80482611d338dea1ef452ea3f7d1ed2fd30d7ea7a9baf6cd47b31edc09768edea492186f889bf54f8419fa60b74e10c1d8a00346c3a131ebf4a564310d5246e661c611b8df1b1db3f5037def66860b39d7632b6b088c1270ed24399e111c53345b03251c15ee151fa447a04635132c3a0197f8e7982035ce31ab480296068545984dd1ae546a2569cfc0421132fc95c98642d8641bf4d3ece58564c453dd4b6bb5bf6fa3ed1873884f1f14f257095ff1560225854959bc1c594088605d5af81306d4dbf293057b8bf75e9aad61dc7cc7fe08830d6f9c734ab6c843f81625e5fee9d187a25347917187271530fdf22bf8e509269e9189a6800ab0ca16be41e7e32d4e510bcb648744bd4a0e990ce4cf250923cb656a05aecd4b88d278f630543437c6ac709f6aa610ac5557aef879f398cbc2f3b2ebc4dcd2d5a83ae47f630c7e53793c794c441425167d4d472b3ff0576b25c140ea61b669e6c67d8e7b7176efdc449afa13bd91b24069cc07045fd80548e16479920b71edc1d5ec7550d8b9d421eed696888647b59baf0f1bba65cc4d8577257daa018342d51ef93843a72b6aeef1652100fdfd325bde86f8b9ff2f9bc9aea49e08898fa62bed59d6c5dca785350141b727cd2e7e308ec3c5e337b40bdc1532c3be3001a63e9783caa7aae59ada9abc3a8cea9d0d71e7c706d31347774986d98f6fb4fee977ffc0666cf3cf41f1229b735df4619ba1205a4073e128aaebb116bf22338068dc39d5c1453bc03973042f5ea600d025c4585d373112f1e68aeacc62c64219ffe2e67ba5a8f468b14918fc4f0b36dbfc4c866ab547f5ef9b8d50254592fc47486c4dd4c0f2ee19709f91379578c803a5af146a745f69a04afd5bec44b5098ad9665e46d57d933d7d976150ec14875af607bc36a4c36099917524359938ba723c5bffe01d6d004b2e1497300498c7b57946530d5fbf4ee002cd1a5c6eae126dea57947c98150c338b9feecab98d1da834edcb348feaf116a81c2ee9d9d75d9c602a799159cb687d4d59aec3872de39ad16781a8b6c73c746cdcb2ffd72f5fd78293d6ab1ae31f7efd37b929c6a8e23c4e088cf11770cbe4254417a8e5cc1911bbdc2981b79b6bf52f7fc6a3aac49ebf77c777e6369dc103be41f7129ffa1a4a87ee0751735c1711dab7128c1fa957b3a126f7167898d3ec4ebb70b78ed9b2b6e6ac169d29f72fd91de9de5cf1a9194004927be6e0a4c21423946af7a29b27954e2d818d60a5b49ed810a9cb8bae5c1a372ebe0c3e4f712b083f8a133bb0f15a309f42", 0x1000, 0x20, 0x0, 0x1, r0}, &(0x7f00000011c0)) ioctl$sock_inet_udp_SIOCOUTQ(r3, 0x5411, &(0x7f0000001200)) 02:03:30 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe7) [ 1706.010223][T17759] serio: Serial port pts3 [ 1706.025574][T17757] binder: 17755:17757 got transaction with invalid offsets size, 4 02:03:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x689, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1706.054316][T17757] binder: 17755:17757 transaction failed 29201/-22, size 0-4 line 3201 02:03:30 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf0) 02:03:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa000000, 0x0, &(0x7f0000000300)}) 02:03:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000080)=""/21, 0xf}], 0xea) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x400) dup2(r1, r0) 02:03:30 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) ioctl$TCSBRK(r1, 0x5409, 0x8f03) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f00000000c0)='\x00') socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f00000001c0)=""/194) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3d30, 0x101000) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x806, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1706.267654][T17777] binder: 17773:17777 got transaction with invalid offsets size, 4 [ 1706.278052][T17775] serio: Serial port pts3 [ 1706.309523][T17777] binder: 17773:17777 transaction failed 29201/-22, size 0-4 line 3201 02:03:31 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf8) 02:03:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x12000000, 0x0, &(0x7f0000000300)}) 02:03:31 executing program 2: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x6) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000200)=0x101, 0x8) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000080)={0x0, 0x80000, r0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000180)={0x0, 0x0, 0x2}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000001c0)={r3, r4}) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r1) 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xd00, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x12000) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x80000, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x0, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={r4, 0x6, 0x0, r5}) write$ppp(r4, &(0x7f0000000140)="14600d2a886bfa6a4a1788f2427c04780c8714d2f5e4e1ab9d6b4ee71e0921120b2965312dfa3988f338cef9fccf8c36c1b5401dad039187c6ab33d7aef3a968", 0x40) close(r0) 02:03:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x11c) [ 1706.502704][T17790] binder: 17788:17790 got transaction with invalid offsets size, 4 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xe80, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x20000000, 0x0, &(0x7f0000000300)}) 02:03:31 executing program 2: r0 = open(&(0x7f0000000000)='./file0\x00', 0x1, 0x140) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r1) 02:03:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x124) [ 1706.699877][T17813] binder: 17812:17813 got transaction with invalid offsets size, 4 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2800, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1706.742151][T17814] serio: Serial port pts3 [ 1706.745621][T17813] binder: 17812:17813 got transaction with invalid offsets size, 4 [ 1706.784626][T17818] serio: Serial port pts8 02:03:31 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x48000000, 0x0, &(0x7f0000000300)}) 02:03:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e24, 0x0, @local}, 0x1cc) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x60400, 0x0) close(r0) 02:03:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x12c) 02:03:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0xe8}], 0x1) dup2(r1, r0) 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2900, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1707.114571][T17831] binder: 17829:17831 got transaction with invalid offsets size, 4 [ 1707.134814][T17832] serio: Serial port pts3 02:03:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2b00, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1a0) 02:03:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000080)) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4001000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x20, r5, 0x4, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048051}, 0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r3) [ 1707.157220][T17831] binder: 17829:17831 got transaction with invalid offsets size, 4 02:03:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x8) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) 02:03:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4c000000, 0x0, &(0x7f0000000300)}) 02:03:32 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1f4) [ 1707.314384][T17850] Unknown ioctl 1074021792 [ 1707.365428][T17850] serio: Serial port pts3 [ 1707.411771][T17858] Unknown ioctl 1074021792 02:03:32 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:32 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2c00, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:32 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4), 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x60000000, 0x0, &(0x7f0000000300)}) 02:03:32 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x300) 02:03:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x400, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x280, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:32 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2f00, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x68000000, 0x0, &(0x7f0000000300)}) [ 1708.115255][T17872] serio: Serial port pts3 02:03:32 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3e8) 02:03:32 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x21ffe, 0x0) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000140), 0x2) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80000, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}, &(0x7f00000000c0)=0x10) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r3, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x80, 0x8, 0x8000}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={r5}, 0x8) [ 1708.181714][T17880] serio: Serial port pts8 02:03:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3580, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffe7}) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000000)=0x100000001) r1 = syz_open_pts(r0, 0x0) accept$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000080)=0x1c) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1708.393168][T17895] serio: Serial port pts3 [ 1708.564270][ C0] net_ratelimit: 24 callbacks suppressed [ 1708.564278][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1708.575803][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:33 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3ec) 02:03:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6c000000, 0x0, &(0x7f0000000300)}) 02:03:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3c00, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:33 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:33 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:33 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x20040, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f00000001c0)=""/61) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x280000, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)={0x8, 0x37ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r2, r1) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f0000000000)={0x0, @reserved}) dup2(r2, r1) [ 1709.044785][T17902] binder_transaction: 10 callbacks suppressed [ 1709.044797][T17902] binder: 17901:17902 transaction failed 29201/-22, size 0-4 line 3201 02:03:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:33 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f0) 02:03:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x118}], 0xffffffffffffed9) dup2(r1, r0) 02:03:33 executing program 3: stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x74000000, 0x0, &(0x7f0000000300)}) 02:03:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4305, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f1) 02:03:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4788, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1709.310799][T17930] binder: 17925:17930 transaction failed 29201/-22, size 0-4 line 3201 02:03:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3f, 0x200000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000040)={0x3, 0x1, {0xffffffffffffffff, 0x3, 0x92, 0x0, 0x5879}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) rt_sigtimedwait(&(0x7f0000000180)={0x1f}, &(0x7f00000001c0), &(0x7f0000000240), 0x8) [ 1709.491484][T17942] serio: Serial port pts3 [ 1709.604282][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1709.610122][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1709.616011][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1709.621761][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1709.924239][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1709.930069][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1709.935932][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1709.941684][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:03:34 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7a000000, 0x0, &(0x7f0000000300)}) 02:03:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f2) 02:03:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4888, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:34 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000000)=[@in={0x2, 0x4e20, @remote}], 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@initdev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000100)=0xe8) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @mcast2, @empty, 0x56e, 0x5, 0x400, 0x400, 0xd6, 0x3100001, r2}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = add_key(&(0x7f0000000080)='.dead\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f00000001c0)="8391caa832c8463c45bd59acf74b4c1807491afcacdf64c05861c6cf79888acfc11cb26ce1b84ef9db95f678ffd3241142281176c33bcb94caeb0934ceed44a63499f3b0bc2c975c112ee30f1ca82c7cb915a2916d0e39c369dfee6637581885c997c0019bb0b2a307c3eeac37d79ceccb7172a7d46e1ff03cf3013a862a55643b46da54e26d121233a41a5a5da68e09950a60e43eb4b16663d3ea27b34ca3a3aa57f4d2fa9881bc6fd4b6506fc999041fa7d97da6c459825e4220608dc9333940cb6d4ad9a38b0c61bcb24d89259d1a4e55c4cc887da7a4d27b6da00a74a10776fe59f1a674fd6d6cc82687bfc9777c30837eb399a4c7e127ce7a5a4791", 0xfe, 0xfffffffffffffffe) keyctl$clear(0x7, r4) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000180)={0x4e1, 0xd, 0x4, 0x0, {}, {0x5, 0xd, 0xb9f1, 0x1, 0xffffffffffffff5d, 0x5, "c2696be5"}, 0xeb1, 0x1, @planes=&(0x7f0000000040)={0x2, 0xf1, @mem_offset=0x9, 0xffffffffffffffff}, 0x4}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) 02:03:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f3) [ 1710.111932][T17957] serio: Serial port pts3 [ 1710.116589][T17954] binder_transaction: 7 callbacks suppressed [ 1710.116599][T17954] binder: 17948:17954 got transaction with invalid offsets size, 4 02:03:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x6000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x1, 0x0) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000180), &(0x7f00000001c0)=0x8) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000040)={0x10000, 0x7777575f, 0x1, @stepwise={0x5, 0x3, 0x10000, 0x100000000, 0x9f, 0x9}}) ioctl$RTC_PIE_OFF(r3, 0x7006) dup2(r1, r0) [ 1710.241391][T17954] binder: 17948:17954 transaction failed 29201/-22, size 0-4 line 3201 02:03:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f4) 02:03:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000080)=@sha1={0x1, "31f8352e4e9e33c54a9db79cdd6b84161c7e442b"}, 0x15, 0x3) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x6488, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1710.344946][T17954] binder: 17948:17954 got transaction with invalid offsets size, 4 [ 1710.362642][T17972] serio: Serial port pts3 [ 1710.393908][T17954] binder: 17948:17954 transaction failed 29201/-22, size 0-4 line 3201 [ 1710.416478][T17981] serio: Serial port pts8 02:03:35 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f8) 02:03:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x800e, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa0010000, 0x0, &(0x7f0000000300)}) 02:03:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000000)='./file0\x00', 0x80, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) [ 1711.072797][T17994] binder: 17990:17994 got transaction with invalid offsets size, 4 [ 1711.108283][T17993] serio: Serial port pts3 [ 1711.109714][T17994] binder: 17990:17994 transaction failed 29201/-22, size 0-4 line 3201 02:03:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x3c, 0x8000) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x10000, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r2, r3, 0xf, 0x3}, 0x10) dup2(r1, r0) 02:03:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8035, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3f9) 02:03:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xfdfdffff, 0x0, &(0x7f0000000300)}) 02:03:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = fcntl$dupfd(r0, 0x406, r1) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000ac0)={@local, 0x0}, &(0x7f0000000b00)=0x14) sendmsg$xdp(r2, &(0x7f0000001d00)={&(0x7f0000000b40)={0x2c, 0x4, r3, 0x8}, 0x10, &(0x7f0000001cc0)=[{&(0x7f0000000b80)="17d1aa69a8d88e8409ca561eddb7fe77a4d464bf576eac03b499759131cdbd", 0x1f}, {&(0x7f0000000bc0)="4dff9b62a1682985ea3dceb8b6d53b765e5cdcaf121f7a48a59dc26a17e34e80052509a58b320b3a415d76a9520aa3fa5f447bc661318707d9f421431985d2566d95e009d5a8df4c97b0fa06cbcb2ac23991e98e23c9b0cf1da57efba4f600095ff6c944b59a7e9c519928dd3064e76cb677921ba4c83e82875be2db35bd55b6798c7c164060847507ef0872bb0f5dfe67ec9b8b036c8b2b838b", 0x9a}, {&(0x7f0000000c80)="3e9e09d04af06e2e830c5e33f1ae991cd6229eb6a1fc6d5cfddfddc7af1c53b80e10caf124fbaee80a9f9e4cd5e1a3b982cc65f6b6b48e0e66416e5ff70843be79a90ecd1bfe53c7a75a358b4ccb8e17274fb5ff9913870f05645103b3e93734f431ffef874b30f7636b2aca6dc7601b5cb6a3e5eab637400dec40a16982f9d4b82b826e0349842ea31eae6305db1796df58e93b980d591662d86deb62ffdc1f435f46a9a273c5665715ac2a6dee3b41c56c9a99b8b1809b9a9181699cc2c87e537d4ec74db63d97f9c7792367cc255623c0a0e9af1ec0091588f9a5e7d9ffdc1069ce41eecf2e994abdf4ef190d04dba103374bdfbf7a9e98253ad78cfe64c8c7f97f1e5c0b4495f80d8be524ada6a3723d0709e1c64a215d89cce38616b1c4d63f100b352b765519b7b143fb40082d01e692d2665de4340420e732c12285379163fa370b3df096ba3634d87c9f20124defad6d4800b0a74e2e529619f638644ff35f75ced3bcebd746edcc0356f1d66d44965155f7ef11c935ce4ddbcabce7cac2b9e3b8123d953a2bde397636c1ff85b0f8c73bce486fd54594a6b92faf36aeb10353e3709cdd202d2f8bc81afe54c317c30500111fc91af08a3e5b3aacbe1e5fb999341b53e8c51f7bbf3754799eb9cadbaba4fdc85d11426d17e6d2e408a5a3c5c5f255a9f2144fca571b902c0a800bc912bdb5305f205196e8115c268aaef871cd2ce895227de4bcead292ca30f28a331007eb2f0e46c72a30631f519ca37b9cfed3267ce4a0f9db660c644715ab42f5889e51cf3f939c3e0c25d676c582b85f1f4f7d9e44b97a28d63a33dd95958fcae7d296405d22e6b9bfe760285eb156bff75db62e33b4ad614344b2130f86edaa00723b2fb9cab50d9ce9560effe73836bb4d04e0fab06882a32e7e843fb430b96f974720a4d7a98ad541b9f53aa9947e14c68e95efc90ad1e1724747d68664b09d676b7fa1427131e275ff4ef385c3064b513108833445bbf805bb560975c145a44f6c5b60d506c1e541302831c93b39def4292b6c7cc0a572f3fd68c3618edf5ed34c6b0cca813b2c57f8b06f69c6b46b85821b8874cc7c03d74d9eebf64892297fac842fb4ff4d59ad9b101dad415180c6458229d5bfeb92fc8876745d44644c1c932f916d9a9fc2400c40587f7a84e457ccea1afc878b581a2ab217c9ba033edfc91b3669f352b4d49ffba48e14ae27f3172c386aadcbdd6c8e049a9bb860a1bea7d88bbd8190e75af576e94f96f9df2ce99149717cf808ddf28410e57a0a9c183139e41a979b44c6b3b615a3af67c4ac88dddbda0b81067561cc43295601c6147636e41d1ba0ead7abac97cae5d97f71235657e82f3e343966d6bc371c155c434042d2b9029397c3c2a321cb2ea4fdb68d01968bb43f371c022faee2c20374ad3c9801b211675fa1a234177464e2c2cf70298b3af90d0446554c74872dccb57ca54b3679ff0ad73e840cbc4bb0e1c744d295494f30be84ae263acae788ecf67e8fa3946b42d7d264e0911b17230957a1c68544e137f2bb536c17c163488c4199882c0b6c93709db441b460103a872f2774ec981a26de24479ecfee2fc224b6132225720094de2efdbd2ba71637b733c83a8c798598e89d4ba20b222c451e9730fc2824e6b0891edf53b707c9459a5a19b776f35e436dd677a4494ca56d963a5bece500c193cb69679dc07d9ae84e5f7d43aaea917f5fe59ceaba328574e64cbaa1dd210cf5cb288b4865bdf46dd76260233bf23b3ba6c11547025751849e3b44d631d940168980f1113cd84260d6c902422c620b83f2d9a6e979ba7b2501492e4e126bfd6bdc82049548d2378d781ee68428807b35f71093958d817e90543133a0336a4f1015ffb4d65803062067e11fa9fc1f5410b4cacfcda4f2aaf681dda30dd350c61c6349b304dc818818b312c4b511a1d7e89647ea532caba9a26306dcaca4a097677f8bc057bc7c2f8043ebfb964bfa32ec27dbb7733288ec7b83d3c7f7cbf914255b28aa8cfa8a9cb02976641b1725ac7208a348916b80c1cc84792335ede0e6b1f842757349d76054958951872550ad8c7138f76b385b36fa8a0c0656cf686c2267bada12d409c97e5412354cea4e9d04fda91a0f584b37ff0af0949a08558ad6806d75cc5da506b9494ac322b20be4c21dfee2bd54652f4427eb403826497dac6dc984538043a055a4726d85a5fa9b3ca015e9da5180ee4ce9bc5f2957e1820eccbad236b659af228e0bbe3537bf1e8e483101e4853ac60995141db8abae30bc6f566d04e419568cb9514dcd990e4ad320aa9eff7863ae54cd30b70feb8ba0e2c0d5ccf70f785c8a69a8d971f5f3d056ec2db1fa22a4051b77c17b9e2ab63d09be8bbb488e49acf5d225994c3cad3106e0ae95c14d5dd328f1c3ff902683b81d0fbde4fdf27cbb49fcaced10cd0706c5d53fe04561789a850aa8ac77f926e58cbb6ef522134e93ed2d534793cf550154c0b25ce635004ee816850f5e71d1ff2622ddfcd2172290d15924a70a8d6799f7acf711be1803139df3a437a922739eaf2b849ca33aee4e7da3a42eeb23b8c9dd910ab43f8505b886a25f134aa6b1ef66652c5e4e9846edc6af4adf9a1b921d29d0e202d48e08de4e5ed3e2ef0e77d5a80f39433ebdc89b9dd397564a1ab73122961640e6bf603e58d5e89f5f39977927562440e7d1b0f02772b3b4e09067c098f3536a59788d08b0bc9d480ddc4504e655a1040afe28c56cfc966b77be7fc7f2d48e58603b38402ed376326d9d02c9944f93b37142d676863ab6781131fe6c4e64fa1011a99b1e1f50d85892b0656f865096979dc291f9dd70053ef8722b120c6772e228aaffc917c0f44b138de37a5c7c6a3f5671d1b0785e7aa026831d4307ca6b6e6853d8ee154b7d5994ea74189139216b5a967957a826452b5df9d0000fe722f0d4ff71e9d98aaafbfe538fda30976c1d88494f840c99d7abfe9944b6ed10803cb799d045f7b743e4e8efa6689d9646af607994c1279922f694faf239f3a7f2f697a4ec0cc28914d07d9398639fec1a69c02a5fb6e2cb426d4559d4d31a3d3fff9168c0fddae3d1dd0cc212768d53c58921b228b097bc7ad27fcdfad44c1757858a44c4325a801a4f1625ee3b364841933d7992c5fa7f2044cb7be8d6ea3fee932bd5f02a43b6f2c6649cd2e12d2430f11f8a052688c7294a4e8581bb5bb40290b941c7ac709eeca469afaf35d19822bb707256f59c3c5a4187c0beea5a0b122b8db444faa23b5e0ac6aa3b3a52c4af6861e40e21ebc2398d269cf139eed11a67cdd331fe6151d3bc2583de5cbb7edd440422925e162cd23dcb5354e39be3f353528997379a92a9361ccf986bd8ca0c5353d92aa29e1c5e4e714f899d1495a805c7648c31b5ccd0cb180899a2647743953186f269af67b7fff3365d75f5aaa15aefc6e2e65841df8d14f7493b39469b8d97d85587ac25c36bf89ee03c476f5599172991760e6a9e6ae0f6a3a3e4855a964252df6106f2d76469cd5710d14d8827529eb8ea9be21e7f7d62f50f2c0f7fd664dbc6189df76bd256cc5d6ad4808f8a6aad93b5e225103726948a6711fdb90c8ee10634a9070a6462e976a1095ff183f6a9b285c8136ec7df898a5339eebe846d632aca3458b46f3cc5178a9f4dd5c111fd032d71c41acb3e8c0c788a8468b8295ecc0e6f6790cb2f5196ebc32e6005ef03eca91f0b77e5cbafcdb160052249c424390f961433cfb93a129f35433975a62cc840ed1b75f339e6671bd73601039c41bb3558faf72ec5e908a88a86681794a36fccf45962b65382118d0d62c729a33e4aef7f30eddd2658ad364bb9825227681d4d3ef009ab5b9e077ed28e1fb613acebb80f31603264d330964bd77cf23a2e5ea2ea1ac255f80231f6fdecb74951b1549ab6de5063d952360f4c6c0e113e25d8a0fc6fd477946943eabd990ab03d935d2a725df88f042169d67f69824351531461b5c45620895025adea4af22efd886fad04e8573a43c75f74932881e9595e8e6e81271e190c0ea644aed03ff54b16238cf59b0e6951c048682c8c1522f9f10b3dad5b0cfa7adf866783e6e9d17746f989e5794dfea68a9928bc7330b0fe081edc4bf41ff97af4756564e4ac9b5ab44db30226a99c902b1f55ecf29eced6cd3f1d862bb71db1a446c32767ca6c3a270186f8c6972d09a866ac7000b51ab23b76e481296609adbec38501580cd62b520abb699c3e7bfae53c1b137b94e61aa0dea084e0fd793afe75940e8e6dae782d980e09a21ab58c557826a19e47a60f3497addc956b645a228e6f56e7faa6e994ac85c6c0dbcd1675a58a5a133322d9ce096c9510c7d886a8c44d5cd9ffc59530b41a538d29bfeee161f7fa737245ccb5730a8f2268d59c38d68c8312fee6c51f772c65edf975e569787ac53d5baaa2decc05b205d334fddb275a65e599a3040025b544b7bf6ee3f0818fc7746ae07b2acbc19c54412d8830ddd2167bf79e1428d35335ff645bbf917f15b33aa6bd985de2bf781df2e8289ca3a9da55aac72da3dcae8517f7e76e488f0af2876db97026d020926fac62dcd659c7b1934a7a3fec4a0cf9b4f92044c05ef9c93bceb302f392f8d7df90786162001452157e3027d6d5379b7c0ec26343a6ff1a76a60251e8f98d676c586d389de3858868c8eae55a2417dec97391bc0859d929d939210e07e2ea75cf6b376c1df3781979c947cfc487199df6422cacb63e0f24d9cc39f4f4d39f3415e322c21fd75fe3b2bcc4f6215029e8df864128d24723f892243c0b9ec0739c39658ede28543514cfed983d00093e63aa94d85566b2a6c3e828eaf71862da799ad849bf089e6bdabaa26769ead7cfaaf48e84f5e7a570fa976550fda396557a5418706965d62de6f22ff1d4bbead75b868643a87104cf36ef77a4b938e0890a911171c6f4b012f1dc58e5ff69b0b699e06e52ec75ff163ae24349825dc9960118ae7314b926c3de75d6286850a7951f807b20a381b8ed07f0e454fe67f45c62539ac066a907cd67e5e2e029536ef154fe9a62169f4953863e837b255c3fa64044d2214f808d5a3236af657419c24b87b44b661ca93907f3ad60e4e7ad650cfa9b707d2a214a4c9e918744668d02dc424ecb6f783a4679fd2b59ccf98ece2cbf5344e164b6429e0af2380ed1b823863377077b0383b3af4948f2c767476d9f4f2a831b801ab40e80c3adbe1bab32b567a25ac72a21ff99df4dff6f1cddf467f213ca2abccc742883f97d2a7074cffc4274c9fedae1df9b6b419cd2d0a1c19cdd2ebb841fcfcb6ab5cf937ba5deed2541cafff462478477865bbcd310ca2b4d0adb0df683ca4815913180587256b1fe9565736e0594cfd9fd84336e864b0f1fb21169a4bc462b9242b1b811f8da157973593a0808f6b4f955d59f5207fa730061006176397066fbe6d1b8c2687068395a396517e1ae79569600e9b15806119a2b172dadc91dbd8b1c71de88bbbde50088085dd3c1d12165c24493d92d601a69499bbc040c5bbfcfe1c6153f271da6adf533e500e9bd906c7744134715b3a399569faf7399f6fbcc28138fc18cee600b9592572fd1be2ad8e74dfca1b2ee4b67cb4ac51de60280e34b9c11f6916c07dd477854f3fd04ef6cbaa83689c930e76b36a803a7272e17f46a59dadad2dae02446710711ebd1768f52ddb98a9407b967c01913bffd00b35f3229c226bee89ad641995f02de283b43acf7827efb09ac2c53aed6ddd3dbc1b6cc2c76082a7023", 0x1000}, {&(0x7f0000001c80)="551115c1166182ba567149d864200a84cb00fdb808a5d5aeba9fbcb7b00de0d0534dec3887a1dd2a1a3b2031066a5109ad7ad1087157cb6c", 0x38}], 0x4, 0x0, 0x0, 0x4}, 0x20000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x282040, 0x0) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r5, 0x2405, r6) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8100, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1711.287007][T18008] serio: Serial port pts3 [ 1711.289921][T18015] binder: 18014:18015 got transaction with invalid offsets size, 4 [ 1711.314307][T18015] binder: 18014:18015 transaction failed 29201/-22, size 0-4 line 3201 [ 1711.386759][T18015] binder: 18014:18015 got transaction with invalid offsets size, 4 [ 1711.439125][T18015] binder: 18014:18015 transaction failed 29201/-22, size 0-4 line 3201 02:03:36 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000000)='vboxnet0procem0)+\x00'}, 0x30) ptrace$setregs(0xffffffffffffffff, r2, 0x3, &(0x7f0000000180)="be5b545274c31a4f0c57d370ab0094d8a885ccb3df9eefe736072be86aeca47a5a5a8745f237a45b83c436530ba0efdfaba29e67f1fda70db2c43f6a183e0889911dc42dbc1cdfc5529c45ce19f9c10e616896df7ed54d828dd71113d64f789b3b7bbf61638b5c2bf45c3b292ae15474649c682007dff1faf29070791be0e54a02026106e03e604cd555fd4c372b6c16718e2fded6ab983617fb8cf097bd65ff3558aa33d302e5e3f55c6ba5610f8b0484") readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:36 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3fa) 02:03:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8847, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:36 executing program 3: r0 = socket$inet6(0xa, 0x8007ff, 0x3f) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1f, 0x108c0) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f0000000100)) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xfffffdfd, 0x0, &(0x7f0000000300)}) 02:03:36 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x500) 02:03:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8848, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1712.074652][T18027] serio: Serial port pts3 [ 1712.080214][T18034] binder: 18032:18034 got transaction with invalid offsets size, 4 [ 1712.096871][T18034] binder: 18032:18034 transaction failed 29201/-22, size 0-4 line 3201 02:03:36 executing program 3: socket$inet_smc(0x2b, 0x1, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x2000001, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000011c0)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f0000001300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000012c0)={&(0x7f0000001200)={0xa8, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7f}]}, @TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x74, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x200088c1}, 0x40) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x3, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000000), &(0x7f0000000080)=[0x18, 0x78]}}, @enter_looper], 0x1000, 0x0, &(0x7f00000001c0)="2a21f2f2ca05efa01cadb0beb3762df769fe47aaeb0c009a61bc74e1e12bcb301636fb5037fea5ea0a792d4881308f009281ca6ae704bbe8eec7d718354d18d35e828c92d2309ccfc577b20ea0e16edcffdbaf9d121f4e42844af4175a144d763411beb705288ca28e2bd1bb31c1f55eebf82cb7a09cb36fc95a36430a519417c628aaac03a01e2157df35e3fbceaec38cd9038f72722a427b50cfeada5e1a615811b33454f2836404d9d1537382ce0dfe49bfc3481e1429739bc69817fd5d4525e390282b0d8ef9168c44763aac1a3f723acbbae4870eba93b0bcfe27a70673cc1ead30824b0fc2a7f95f465678c8444fa04ec3822e886bce38c74061e1e42ebe292a4c0a9097053effc121bebf0c6772b3ea23da363b97a4c4d4dfd6a7e186d243d1218a105372a172a84657707da9eaa0ca02099ebebffec9772dfbe163b9c3b83fb204bd465448f1a6ff5378fa0f55dc7d963efe844ba6a24b8dd056ae9a52070520c07dc586979560b52dbb9708cca65b971b2633116d8f288ac3d697a3188ab4e468ae7d84c217466ecaab2fbf320149dbb26df128ced1b13d54539a1beddedb022ba38ed07a4c7f51f59eda1a283401624d9c47a62dc85699f3fccd7332bb765a15b787f726463e1d465d0bc387607ff7eb12ff564d4b0ebb8ffe4e42e9fa9ba4ba0fd5b0c060cd8ffc16218f6b438e9f2bddf114d2294a7b511fe237d6b2cf038f10e41f250c8ff5bce0f08997c9ae8be5d1c1225ff7aa01c4b81dff1d7af5d7daf51a79bbabefafbd37e43ea81464119bbb601cff299e47264fc37d45c0d791c02aa8d9a03ca975c68d8d9552a3bbf20290a7531865c0f95112b5243147cf489b2e9fa0f95761fe04fd4e179999b1f12dc01727430c7641e1f9ecad3ec8f69395c1103d8b9ad7aabb53d72924e3f59be824966b4b9a2f7cbce37e8e41bf931b0c4f3db7a081df521fc32f99f69d7ced2279e6121b6e64d96642150f2ce7ec078bda3fd6d1ff83885be85ab86b5f7216f6c92650525d8a486fdb75d1eb310c829709335636832f09893dc2db1bec890e16e4525101904aa7ed16777aa11e77e392ae41f5eda37dbdfe1f2ce18095761722a43957bbeca4a6f21a25156d28f1d99874cad7afa46ee5addef78f3ae934da5fe9b0ae2978a91757c3aab05c5545e75caa7d07155e6ff5c0ee94121e948459bf49967711677d0b56abbb4bbf7defc6829995e553da867eb85d7928d71c6ba97fd7c54365cd3637a6e584215b6abb3c018032b99aeb52ceb25fa2d74e08cbff3153800e0603c8d38b1e0c9be16496f9592f79df5df19983f4b6f3d46abf55d21a909ae459eb0fafa9cd5e81a0fbbd3c6be8ff7da87b249195fd4ae1b5877e082dbeecac65fa89475ff28b73431f43dac4744de96898cc55f49e9ba7d2350dbff089310227e8c1845c2458afbaf7efb5b2a4b5cc9e80e13f45c8309fafa381c57fd9556ebe443d70bacc935f9cf7f08ccfa99c609ef909eb04fdddac76ec20dceb97cb1823bd5ffde3fc21e18ad68defea349a710ef707a52d795316f3ebf571c44ebf4f3060dac114a3266ac5ed981369a469bc83a15d39eb473453146d08d59744bcf5dcfddc4a36d55d97a2cdf4469f9a5081ef557df46e8a232c36c07b56f7629c32e33833791e75dce79725998b29da2d204ab0788e6019b45f3e9d57998a008292441deaeb96aada251c3907f100ba31933bbae913acf7e5f71b52eceafd830f438a1ebc068a81aa89aaac1a14c93dfb78473da4459b361bb05738bb2bff5bdf998397158838722ddc676651190e2e40d183063ae1478bbd4e4c36e5112e98b7d03b025a47815bd75c869baa0da0beaf266e42cc98591485febe0e0de756f5faeebd284279c779cec9dd836eb8e61fed029c53c6e93aa5d83dcd14e4a4d33c869b02589ef5bba5f3f5356bce87200644adf3ad1ed8e04084a7003c04bab7a3fc24a827474f54105da17b0546a14a611b6b994be28a292e659780d7a7532f50487af9996cd5b8193b80827ca7d7017469b291522df367b287fa7c1b7e59d4c0523e88c8bbcf391c6573dc2e63da3320e5d56ccb9ba24910d2b24187e387c8c6fe976172f290f831194061d68eee6a303ca92fdced6e652d58f89175ab4c684a4c027b0f103063a7d1fc15ed32155b783b3d8b1d1b093e2c46979bbd386ca9a9129abd92b5e3afa50d5e4a097350f92e165f4b5f94ef44cc3d8de405a3d7cb8d6b1520f78a2b8ae488c81e01e9d25ba4df6287897d36176221a1feea425f41182115ea5dd7220e93549234bcc997488808251be397e4bdec45a298b6314e61757503f1301ed8a5739f209ef0c8d46453039a1db2134c4d31bdd48d9be23238157a3f29f948c5864a0fef6d0ec69188c9c15771013e9a4f0b2f2f6b77ed6c26c0c49a136b1342968e1d4de7142fe8fd3d7cd5e0e602a6176d7079e1e503fa1eef16c2d34815d178a6a7757f36cd82211947edecdf66611a1b5d5000dc2d865007621fe262550ce44215ef1e2b00d527956b96b2f49d714a1806109a6c86bd15dd0a805a7608b1b4185162d1a3ae3926db3d4e55a6a562db949d28b037f470d30971a07e07661f70ef55e739ff1a6c15c705b253c53d2562a595df01da2de82e3b3d63fa9c11b6a8453e89075004518e82e9a41b243e1faecbe2a0c919cef72f00584427762b193f9549cc3e42c3d10d119ce346bec877ed2a725d2facd81fca5e42c1c35f2bdac61cfb9a57fc53c85126171692efe3826a5f87dc0452b29acd0e65c3af0ff6fa3f4201659a39ff0d736a6db8483144f4821a351e89eccfe68bf96125fd273656b7750fec7f27864e5c3a5baf0eb5d23effdd3e284c2689fdd36a93418659b51e7a569ce0cca8b42efbbabaf4721055bdbe6c3d910b9d85d59679d4f35f6dc3d78eaf8ce33efd46b9ddfbb3764bf51952c187cb93eab52a77ff25729fc047379e94f4d5feff3f255fa110b2a07d6c76cb4cc9e8e75ce54c83b661c981c163f6a1cd33a2aacd33ef88606978c88015a650e2efddda4640bcaefba01ca636d107eec5bb292caa3c6ac826465fa4a4bc656fe67c222dd1e11a8f5e7826bcdbd0e9525c75f3905f187e33c3a9c0c94a4095433ce8befa859a5c95e0733b01746912f116bff1bc99cde9fb22d63381a747f3b3e684e5991bcb886083e86d5fe86709ea68223bd30e52c0333a8f947fd71074838874499d87615abe63d77984a9567b59880fcdac3613b812c695c10542c5f3042aaa850757b914dbefc055ce5f8652ec4bdcb925a53a858313124fb4da6114da45fe286dc842f865a9f3be86bf60c791f869fc4ac9b7374c9147125f7f27a952b9f144d6db2cc5766704309503d3785b0e61b906135dbb731921f87c755fd540b9d3433c1653f004666ae9d23e89c75a693452ae7df579e38938ef714ddc34e28362e3da639fad3dd197e7ddac0adbd65f3b635c2dec4e2f56642b798218f64bf8f155f46a8c01ac6e000cba655cf73e887a71c54a89ecea17ca175726b389c0bdf860bad668c519fb7b1a5bf7d2603348305023dcdf9d95711fccb31db1def714da806a7fe7718a917c5057df03ea3aa0830fa199db2aace57bed0c748dd9e5b810ebd2fee8ad85212c59711438bf32472b101f4156c788455d789effa47bd40780fa43117421117c75374cdc10b7cb5054eaa8954e90559f04a3cc3c919fc66f3791487153b40ab6248999b8344624a856d2117f8f5bc13121f8a2a5589137c74bf2c4a4983351eced1557e9383663ef45b6823a5d0dce001ae135c757db89e134c73c64a76c7908fbd8afb9857ac8d75860e21989fe4f4e8438644a23d6279f4823c041796f059020e5ecdd78b9c37f9a9b222859156116e6c98dd00badd92e6554b8060637e78a34714e292da14e7be6250af74030eb5f5b20be175c4246af6b5e2205f66efc0e98dca78407033a6c076bdf83fe1a353452459b98754726225e7d953cf5710b1f217c6276867eefa5aacc859fe8e4d05c54ad00b808eca6b72cc52bebcab64b70b3bc6005098ee3f742540996d2a85ba111f40f5d51933f4099f1720aef0df32c19894d22b7eb28d63de3c75b29657b9f772acb5fab3870cf2d5e29ca946a4a8186ef5829f745dd13817198ff291b46633ba2efb8fe137c6118b37ec433c3b7c1bea0a0958ee9d4f2dd7f91f49bf3fec11b5a57d762d734ba1c2f3b0fdf0065537e193c38c27ee489584e361dfcec8827889c5a4cb2b87397c3d7b276185e7ccc00b908169765160e8114d2ad7fe9c1207aa6bf2b5e1024b05fc189a9a57e02834738ccc8f232a28213c78b0e5325c56039115ec07a52fc2cc1fcd66c84ab8936400cabf88fb3d0a19324c81f28e089d53778a315ff473ce80564a2ed6501df4c76b0a4d3193b34d60750a10b895f286a3c67da12e300a3be77acd4f0085d3ad8f268d412488b34c3503b8b4e349cf26e1a25fddafc9da338c20fe2b009af86a7f8e83f041fde7f9cdf4ca07f921cb0a8f924effda4cc4c5d0ec5830d203b98bb9b887fff6fca64d04bc048cd548862bc658bdd323555580b8426f1e5a9a6aa224ab4138b1d867f8a8c2daecb6aa031874c20be95c9fa46307c1df2ce504ed9763cdf86938316a7b94d45121083e65e96ae358060f221474ad5be787a1af9f2bcf9295f44a526e87d1042db12a8f4cc86bcac83ef9f1ad2eaa6d309047d58b5e64526efd67a3ed296c7e4243082e6c170ffcdddb6a569e235f64c2acf57106bbd4686a2d0b64dc2230d105ce21e50613a6c35c7001560eb9f3529559779856ec046e4ebe1151e6daa2a562fd20b3d918c1e8d01495a6fae9241e67781bf40bb13eb7c9b8459eb424d0447afca94d90bdb55f9a047f1c595ac610a386a36dd8c63655a29f98b87c38eb2185b55b57cdda9b0aae5d093af0afdc2beca38da48b57c45b2ae941d5d2b96ef4c821a4b2546214d1614bec48d55ace8b6f84236b522b877a449b6daa60ec7a1141c1ce997b115192c9784a7ff77c06ccc0a45d33ba81d374ecb0f49c61425ca67b2146e18ba0d175001c11bdae104ac4c51ba130d474aa0f8e4456d84a32b39dcf106f1067f3d839f72a28fedd5966e7a5a3c8efeb3c12908e4741cbb77634ac8f9aab91831e56306b100e1dbfd22e497b9016121d3a97338feba33b7e2fe67c038a9bc3fe5a7d1a5a56634114a2fa600c3b37d9473d299c98690fc2a1042b70905a0614915f38c8e919bcb95d447b2a73514cc7425818cf9ccb983259c9dfd0216c1c95e48c9cb3f6c0df92e463b3b860863b3f054cf1284bd2e5cc8735b394e0cffd5ccb7d0a2438caa31c195eda6d1fc8bcad1cc3f0a8c1b339d442935f988368b5ee75d1cdd66a1ee8326041c8c24223c5882524d9d982c074e0bcfc380b5995ece36f70ea814810065a2d2984bbb4c5bbb183b04c22adc1e489b646e315b18bb5b4495946b5f8dae3fb3b41f492cab4254cb7cbc1d0933f5b837a722dc808bde23ed9461f7aa68d69664064d21c34213a3abd52a0fc34a5727c9580e64bfaa61f62da78f55f6289dd506a189d170c5b60272252bcec17c1fa406a81213cb30459a3f0473a076802bf9de60078ee2d85cb0cc075c792f5f48e88eb8e2580f8a53652eaf92b754fae11a6ec5d2c753998f47381f8faeb620822b67d970926a5913a0457c735d13cd179d0a5ab441b0d0cb3f91e0a24c3ec7e596740f9a35559c9165d5ad2139abd30cf932f08a3f32f26c68eb4bc277065f2d7547b5b734e77a"}) close(r0) 02:03:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x1) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000000)=@generic={0x3, 0x1a6f, 0x5}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x1a0ffffffff, 0x0, &(0x7f0000000300)}) 02:03:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8864, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1712.318563][T18055] serio: Serial port pts3 [ 1712.327596][T18056] binder: 18054:18056 got transaction with invalid offsets size, 4 [ 1712.370328][T18056] binder: 18054:18056 transaction failed 29201/-22, size 0-4 line 3201 [ 1712.405410][T18056] binder: 18054:18056 got transaction with invalid offsets size, 4 [ 1712.414114][T18056] binder: 18054:18056 transaction failed 29201/-22, size 0-4 line 3201 02:03:37 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:37 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x600) 02:03:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto(r0, &(0x7f0000000080)="1110eb7439d723cab50f2e99fc6d2c92fffc56cf2cdff034531d559476968070551ed7a81317153de3a4ca41ae4d12bd4651311455846c31ded9937b6abcc2416a6a69068a573a1b0565573296d0ee8d56f3bccbb1b41602e414595cbc82f03d3d4b2dc80d053e87b5b1c5882ab442e18d4ac3405e5355804d", 0x79, 0x4, &(0x7f0000000100)=@in={0x2, 0x4e21, @multicast2}, 0x80) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8906, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x100000000000000, 0x0, &(0x7f0000000300)}) 02:03:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) [ 1713.014660][T18067] binder: 18064:18067 got transaction with invalid offsets size, 4 [ 1713.032902][T18070] serio: Serial port pts3 02:03:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xf000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:37 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x700) 02:03:37 executing program 3: getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f00000000c0)=0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='overlay\x00', 0x8000, &(0x7f00000002c0)={[{@xino_on='xino=on'}, {@xino_on='xino=on'}, {@xino_off='xino=off'}, {@workdir={'workdir', 0x3d, './file0'}}, {@default_permissions='default_permissions'}, {@redirect_dir={'redirect_dir', 0x3d, './file0'}}], [{@appraise_type='appraise_type=imasig'}, {@subj_user={'subj_user', 0x3d, 'usermime_type-ppp1)'}}, {@obj_type={'obj_type'}}, {@euid_gt={'euid>', r0}}]}) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000100), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r1) 02:03:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x200000000000000, 0x0, &(0x7f0000000300)}) 02:03:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, &(0x7f0000000080)={0x8001, 0x401, 0xffffffffffffffff, 0x1ff}, 0x10) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)={0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1}) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) [ 1713.247128][T18090] binder: 18089:18090 got transaction with invalid offsets size, 4 02:03:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x207805, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1713.287392][T18092] serio: Serial port pts3 [ 1713.764255][ C0] net_ratelimit: 16 callbacks suppressed [ 1713.764262][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1713.775800][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1713.781684][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1713.787485][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x300000000000000, 0x0, &(0x7f0000000300)}) 02:03:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x900) 02:03:38 executing program 2: arch_prctl$ARCH_GET_CPUID(0x1011) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x200800, 0x0) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000140)) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x1e1c00, 0x0) accept$alg(r4, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000000)=0x5, 0x8) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x80, 0x0) ioctl$TIOCNXCL(r5, 0x540d) 02:03:38 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x207835, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1713.982000][T18107] serio: Serial port pts3 02:03:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xf0ffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xa00) 02:03:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x18000, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x0, 0x9, 0x9, 0x2168db26, 0x7, 0xffffffffffffffe1, 0x0, 0x0, 0xfffffffffffff800, 0x0, 0x1, 0x8001}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x13) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x400000000000000, 0x0, &(0x7f0000000300)}) 02:03:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x1000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1714.084256][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1714.090184][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1714.096131][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1714.101902][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1714.161600][T18124] binder_transaction: 5 callbacks suppressed [ 1714.161615][T18124] binder: 18123:18124 transaction failed 29201/-22, size 0-4 line 3201 02:03:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000080)={0x9, 0x1, 0x4, 0x10000, 0x2, [{0x4, 0x8699, 0x400, 0x0, 0x0, 0x3000}, {0x71ae, 0x2, 0xf980, 0x0, 0x0, 0x300}]}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r4 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_S_AUDIO(r4, 0x40345622, &(0x7f0000000140)={0xfffffffffffffca9, "432f4a0297d77336ee5774c3b7fdec17484d9b0b89d11fb08e3027a26299b096", 0x2, 0x1}) close(r0) 02:03:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/btrfs-control\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000400)={0xee, &(0x7f0000000300)=""/238}) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x6, 0x202003) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2081000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x84, r4, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x4c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xdbf0}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xf0fc}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5d7b}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xbf}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xccd}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x20008010}, 0x8000) dup2(r1, r0) 02:03:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xb00) [ 1714.242803][T18124] binder: 18123:18124 transaction failed 29201/-22, size 0-4 line 3201 02:03:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x500000000000000, 0x0, &(0x7f0000000300)}) [ 1714.324304][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1714.330101][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1714.365503][T18136] serio: Serial port pts3 [ 1714.435321][T18146] binder: 18144:18146 transaction failed 29201/-22, size 0-4 line 3201 02:03:39 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xc00) 02:03:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000000)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000080)=r2) dup2(r1, r0) 02:03:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x3, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e20, @local}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x23}}, @in6={0xa, 0x4e23, 0x68c42084, @rand_addr="5789745d6615eb02130f7280789e23ee", 0x8}], 0x4c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x600000000000000, 0x0, &(0x7f0000000300)}) 02:03:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000000)=0x100000001) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) listen(r3, 0x38000000000000) close(r0) 02:03:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe00) [ 1714.916901][T18160] binder: 18151:18160 transaction failed 29201/-22, size 0-4 line 3201 [ 1714.945269][T18161] serio: Serial port pts3 02:03:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x700000000000000, 0x0, &(0x7f0000000300)}) 02:03:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x40004) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf00) [ 1715.079086][T18177] binder: 18176:18177 transaction failed 29201/-22, size 0-4 line 3201 [ 1715.118090][T18177] binder: 18176:18177 transaction failed 29201/-22, size 0-4 line 3201 [ 1715.176830][T18183] serio: Serial port pts3 02:03:40 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x5000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x800000000000000, 0x0, &(0x7f0000000300)}) 02:03:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1100) 02:03:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x82, 0x0) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000080)=0x7fffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x2000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x7fff, 0x81, 0x5, 0x4, 0x8, 0x0, 0x520a9c36, 0xffffffffffff7fff, 0x4, 0x1, 0x10001, 0x67d}) r2 = shmget(0x0, 0x4000, 0x78000000, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1715.863226][T18191] binder_transaction: 9 callbacks suppressed [ 1715.863237][T18191] binder: 18190:18191 got transaction with invalid offsets size, 4 [ 1715.881188][T18198] serio: Serial port pts3 02:03:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1400) 02:03:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x5782000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1715.919955][T18191] binder: 18190:18191 transaction failed 29201/-22, size 0-4 line 3201 02:03:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3ffffc) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa00000000000000, 0x0, &(0x7f0000000300)}) 02:03:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) dup2(r1, r0) 02:03:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1800) [ 1716.073880][T18219] binder: 18218:18219 got transaction with invalid offsets size, 4 [ 1716.096461][T18217] serio: Serial port pts3 [ 1716.121983][T18219] binder: 18218:18219 transaction failed 29201/-22, size 0-4 line 3201 02:03:41 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x6000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:41 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1c01) 02:03:41 executing program 2: sched_setaffinity(0x0, 0x2, &(0x7f0000000480)) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0) ioctl$RTC_UIE_OFF(r1, 0x7004) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000180)={@my}) epoll_create(0xffb) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000400)={0x6, 0x80000001}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x803, 0x9) r4 = memfd_create(&(0x7f0000000f00)='i\xb4b\xca\x17\x05\xb4\x93\x7fH\xbe\xbc\x95\x87h\r?\xc7x\xbd\xe2R\x02\x7fX\xd6.\xd3\xbf]\xe1\x86\xadqPD+\xc9\x89\x0e\x15\xe9\x031\x1e\x03\nE\xccA\xac\xd8\xd2\x95\xb5^J]\xb3\x82\x9a\x10\xc1\x18\n\xf2\x9cRp\x8fww\xe7\xcb^QdO\xce\t(\xe3FHM!\xb1\xd7Q~\xf6L\x12\x13\x16}\x17\b\x88\xe5\xd8\xd6\xa5\xa2\x00\x00\x00\x00\x00\x00\x00\x05\xcb\xeba/\xba\xdb\xca^\xfe\b\x88l\x97\xd2\xf7Y\x92\xd4\x93\xbe\xeeY\xd8\\R\ae\b\x14u[\x13\xbd\xcaf-\x1a)\xf6\xd0\xa0\xdb\x87\xf25\x1c,\xed\xcb\x89\xd8\"\xa3r,\x04\x90\xc2@\xcc7eq\xcb|q3\xe2\x84\xed\x91\xa0\xae\x8b\x85\xde\x18\x11\xf8\xde\x1d\xe3N\x95q\xf5\xf4\xdd8\xb1\\.\xb9E\x87\xb9fh\x93U\xa8+\xbb\x18*\xf8b\x97', 0xfffffffffffffffd) r5 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) r6 = dup2(r5, r4) bind(r4, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x3, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) getpgid(0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xf48b, 0x0, 0x0, 'queue1\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000a40)={{{@in6=@loopback, @in6=@remote}}, {{@in6=@dev}, 0x0, @in6=@local}}, &(0x7f0000000080)=0x6a) setsockopt$IPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x41, &(0x7f0000000980)=ANY=[@ANYBLOB], 0x1) write$sndseq(r4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) fstatfs(r3, &(0x7f0000004200)=""/4096) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f00003b9fdc)) r8 = syz_open_pts(r7, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r8, r7) 02:03:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x1200000000000000, 0x0, &(0x7f0000000300)}) 02:03:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000200)='trusted.overlay.opaque\x00', &(0x7f0000000240)='y\x00', 0x2, 0x3) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x40, 0x0) sendto$netrom(r1, &(0x7f00000002c0)="73ea2c637e0fb8b510b1e699f75be4cf4fbb97feb16562ef71b5c2ac22ddc79ee52ce99ae8d050d29cf4da178278bc0272c1534d3d45abc0828d2529acd4383e00023f063285a58642e57b5494c9b1b2f9ea33e046e18a91d629c4a52ffce24e20049bde6f302f66dce0a068d6056b022205144fa27b7c0fff65b85c35ec9901788ee62f27963cea3ed40ccc032e437ce123e95b98ce5e4c0b31161ca4b3a2a0e4a3f27cbb7a1a6e533aecf45e43b21153fe84bcfce37a43ffb957ec55374da7d3be9d53dec801396ee39316b255ac47b4764912920854", 0xd7, 0x4, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}}, 0x101, 0x4, 0x1840000000000000, 0x101, 0x5b}, &(0x7f0000000000)=0x98) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000140)={r3, 0x8, 0x3, [0xfffffffffffffffe, 0xfffffffffffffffe, 0x40]}, &(0x7f00000001c0)=0xffffffffffffff7f) listen(r2, 0xff) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendto(r4, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r2) [ 1716.821739][T18238] binder: 18233:18238 got transaction with invalid offsets size, 4 02:03:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1716.862441][T18238] binder: 18233:18238 transaction failed 29201/-22, size 0-4 line 3201 02:03:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x2000000000000000, 0x0, &(0x7f0000000300)}) 02:03:41 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2000) 02:03:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x4302, @mcast1, 0x80000000}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e20, 0xa00000000, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8c20}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e22, 0x8, @remote, 0xc6}, @in6={0xa, 0x4e23, 0xe800000000000000, @mcast2, 0x401}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, @in={0x2, 0x4e20, @rand_addr=0x20}], 0x221) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8060000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1717.010762][T18254] binder: 18253:18254 got transaction with invalid offsets size, 4 [ 1717.034976][T18254] binder: 18253:18254 transaction failed 29201/-22, size 0-4 line 3201 02:03:41 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2400) 02:03:42 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4800000000000000, 0x0, &(0x7f0000000300)}) 02:03:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xd000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:42 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2401) 02:03:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x1a757eb0, 0x6, 0x7fffffff, 0x8, 0x1, 0xf1a}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000240)={r1, &(0x7f0000000180)="6678de21a01631fda8cc44cdd3878f022295bd60880c0905745da35d32f26728b115db001ff5743fccf4b6578055c36838cbb1ed1937b0e9ce8259178d5fd8336087247724c9d0343341d2016ad77fe58bd2d67039ebed9980e9d806b1204c577630cbce53e28ee659f48133e00558967b058189d1eccf747d560a8331218231b0d7abc470cee12cf753ad0d79e66712a529a58ea7dc1a296edd17c4213bd6a050bd9f6223b87418", &(0x7f0000000040)=""/87}, 0x18) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) 02:03:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x28000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1717.807672][T18276] binder: 18274:18276 got transaction with invalid offsets size, 4 [ 1717.834780][T18272] serio: Serial port pts3 02:03:42 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2c01) 02:03:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x4c00000000000000, 0x0, &(0x7f0000000300)}) 02:03:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) write$nbd(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="6744669800000000000003000400000086a4aca3f7e86ecb5c4496be7d540496cee7acbe22e251a9597dcccc8ad7c5ca02b6e8c3f4ec087a232c3978fef16432ed4f6b45d97d06e186ed8bac5cc8aee7f51a2d308dde013929b9352d0ebf35faec34e36000000080000000006f2aa4000000000000a8189c1f116b3431596d1a8932f68b60a8554d1bca54d3265ddf"], 0x8f) 02:03:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x29000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1717.993291][T18293] binder: 18289:18293 got transaction with invalid offsets size, 4 [ 1718.020042][T18299] binder: 18289:18299 got transaction with invalid offsets size, 4 [ 1718.031419][T18298] serio: Serial port pts3 02:03:43 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:43 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3000) 02:03:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2b000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6000000000000000, 0x0, &(0x7f0000000300)}) 02:03:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) prctl$PR_CAPBSET_DROP(0x18, 0x4) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) ioctl$sock_x25_SIOCDELRT(r2, 0x890c, &(0x7f0000000180)={@remote={[], 0x3}, 0x1, 'gre0\x00'}) 02:03:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x9, @remote, 0x1}, @in={0x2, 0x4e24, @empty}, @in={0x2, 0x1000, @empty}, @in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}], 0x78) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1718.765058][T18313] binder: 18307:18313 got transaction with invalid offsets size, 4 [ 1718.774622][T18314] serio: Serial port pts3 02:03:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2c000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:43 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4000) 02:03:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6800000000000000, 0x0, &(0x7f0000000300)}) 02:03:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x408802) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.current\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000003c0)={0x7, 0xfffffffffffffffe, 0x8001, 0x1}, 0x8) accept$ax25(r2, &(0x7f0000000280)={{0x3, @netrom}, [@remote, @default, @default, @remote, @bcast, @default, @null, @null]}, &(0x7f0000000300)=0x48) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r1, r0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000040)={'erspan0\x00', 0x200}) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000400)) ioctl$PIO_UNIMAP(r2, 0x4b67, &(0x7f0000000380)={0xa, &(0x7f0000000340)=[{0x0, 0x3}, {0x0, 0x400}, {0x800000000000000, 0xfffffffffffffffd}, {0x200, 0x9}, {0x100, 0x6}, {0x996, 0x101}, {0xca3}, {0x0, 0x6}, {0x100000000, 0x6}, {0x4, 0x10}]}) sendto$inet(r3, &(0x7f0000000180)="133f3e32618ed722cb30376e119019f55697fb9154165fb7e9bc544661d379216d8f12c66e757ba47282f7f1eafa9f3eaba8e4f26a35a4502b2acdaa94af42185d91fe6d063bbf368e8a88b72eee0bc3fcc0276598fb89916c195de812a51e911a33766f6cc5dbdaf3477da2c598c62325597f845e01470691d07f078b8f4ca6f098bc20da9fddfb3ee21b90f2794a680ced1052c21bdc123be6cdae31f58d5000296191990132996f6982486b7f19722018f33067c14a39f3393770ff72fc0098eae36294548bea6a", 0xc9, 0x4000080, &(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x7}, 0x10) ioctl$TIOCSTI(r3, 0x5412, 0x4) 02:03:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$llc(r1, 0x0, &(0x7f0000000000), 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2f000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1718.964276][ C0] net_ratelimit: 24 callbacks suppressed [ 1718.964285][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1718.975744][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1718.996577][T18331] binder: 18329:18331 got transaction with invalid offsets size, 4 02:03:44 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:44 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4400) 02:03:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x6c00000000000000, 0x0, &(0x7f0000000300)}) 02:03:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x201, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000140)={0x10000, {{0x2, 0x4e23, @multicast2}}, 0x1, 0x2, [{{0x2, 0x4e23, @broadcast}}, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}]}, 0x190) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x35782000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000000)={'veth1_to_team\x00', {0x2, 0x4e24, @remote}}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x200004, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) read$alg(r3, &(0x7f00000001c0)=""/175, 0xfffffe95) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1719.607379][T18349] binder: 18343:18349 got transaction with invalid offsets size, 4 [ 1719.638352][T18350] serio: Serial port pts3 [ 1719.644595][T18349] binder_transaction: 5 callbacks suppressed [ 1719.644612][T18349] binder: 18343:18349 transaction failed 29201/-22, size 0-4 line 3201 02:03:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3c000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:44 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe700) 02:03:44 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$SIOCRSSL2CALL(r2, 0x89e2, &(0x7f0000000380)=@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}) ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f0000000080)={r1, 0x2, 0x4, "2c1310dcdf21578633e457fd3b9a1eb9cc230068121e93af2a8024a8732a263650748b501db92b2c859c150d13791e659b81e96e23ddc1fb13ec74d5f29d583ac9a525bc3c2226612a41b9083db90864867164d98c0c410402b6adf106e555e3952a479bc8054c7b119b8c3b2b1cd84bdbcb910f3b09ad8e6065e08c6bddbccf4d9a7f5b8d6261e8e365cd2e00e6521bdd2215be24434b77fb027a73ecac7818d1b68bbb2b215b1df590462f3f0d9a2c016663e1c85efc83186f3f498d43df3a78442027b3c63f96f9ae44898b89e3d31b7f5ba77fcf74794e35e3d8fb2203ab8aeaa28ea8f7d84065"}) ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f0000000240)) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x7}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000280)={r5, @in={{0x2, 0x4e24, @rand_addr=0x5}}, 0x4845, 0x3, 0x81, 0x0, 0xa3}, &(0x7f0000000340)=0x98) close(r0) 02:03:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @remote, 0x7}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0x2, 0x1) sendfile(r2, r3, &(0x7f0000000040)=0x100008, 0x8001) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$SIOCRSGL2CALL(r3, 0x89e5, &(0x7f0000000000)=@rose) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) dup2(r1, r0) 02:03:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7400000000000000, 0x0, &(0x7f0000000300)}) 02:03:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x40000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1719.865855][T18367] serio: Serial port pts3 [ 1719.893960][T18372] binder: 18368:18372 transaction failed 29201/-22, size 0-4 line 3201 [ 1719.942764][T18377] serio: Serial port pts8 [ 1720.004233][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1720.010138][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1720.015996][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1720.021743][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:45 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe803) 02:03:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x7a00000000000000, 0x0, &(0x7f0000000300)}) 02:03:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100), 0x0) dup2(r1, r0) 02:03:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x43050000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in={0x2, 0x4e24, @multicast1}], 0x10) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x88c00, 0x0) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000200)={"068747818a5b5a39bc7fd882d420d0678a056fe6d87670c2aa15455336dffb778113bc8ced93969fa79a547b533328b0c986252ac071fc6385cc2e3854a4da37ee23975339bacc5b34454cd0eda3294eacf269e35faf97d6c6d6b5628617545e6cd662e7f84e3edbd97e64bffee4cd3e884e2a7a185e4202868360bbaeaaa4179f6c26c040ddd8c12f6fdca4d2261efcbcec9f20a2127a4a93221edcc76faec9fbf2c5d86ae10ea18df94f87887ba84652ab339925c85b7d98325fb2a757e50586eecf1a588e33493ca3053001eaa6139b78e659e11d32ed4bf8ac5bf2c12c1330d94e03136016bd6eb1cad4d43d7aab52714e6eb03ea56de5bf91b362b948f79b5b54470e665be751b0a3e19eb596fa3591702666147485f3b03c079c23b0452ccb5d4bdf6add34dc610fac82d3baa2a93faf513fc8f102084ab0e67b28af581d2dafa5d0bd9e29b5fc7d72f2524f4589df67c36d65dd1f3250b68bd8f532aba4248b96c6dd7a72a4d6ed6daa3758d1204b806cf10e120514d576f069df39da157d2bc37b59df62a5d43476edeec087494026d6af7b6c61adf635c16f2ca7b535e6868439521fe69afefe758a14c8ae0781b44c559dead8cc82001b23bebc7e53f05b6fb110b474ea6e9fa121e26017919b24eb57daedbd1a21fd5d73eae81f1a3da9529aaf3f67308d81cb904812dccb1d610cb771251c5137e426fe93245afad0e7c6d07acd8f8b923ffffa8a5481d020a6af17bd0d18208ee6483bd634798b5cb8e64176b966fc88708a45f37aee4a517295b444d901c843b1896e3fd3f732be631815f388a18a4e10da379f4177ff869352986167436fd82ab972d87255cdd161f21ec79e999f0bd28aaca95dbcb1140b630c369f2588e929244ca6afdae5dcd76eff88aeba9f6850c923928f02603ba8eb3578bc652fd40c891bc826afaae0945f917cd7a1a7fac62365987a54a89ec9e533d128e6bd5061858cdf7235856968ad9a9379c3573141fe00f1fc45cc7e6b74cdf3133af84a294d4bc5faff84b75b64c8309b1c2df6c5d08492e6a50cb95d4c6415f9d28a4f69493a3f120dcf91f5cbedc512b315a0be6ca2a6d976052d690c8f2cf765c2eb44e657e08fda6f9f3aff3d4a064abb26bfe832e1eacff171b599047464055ea9e4624b7106abc7985585f6ca0247b3921786c6e9ea2568812d1357bb616e601b0272938097dcd253cea2b8f349b8f413b9c86e08d3a8e73ef7c806924d924adb126fae5cef89880f60ebcdea6a7b869895acf706495819952d1636f08ab6044f4fcbf2d3eaad2f10e178a9d3a27262ac46ffdb6a0eb08f12a401c46e9b09f15e869f1897441f7833348fc2ae43ccbcabbd0cbde5b1928005d55abcac988d98cd21abdd39cb12c3f741e7cdad56b90f2dc1173c0c4d4340ab8e0be03591491263b735fd2b481b"}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x7, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x9) sendto(r1, &(0x7f0000000000)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f0000000140)) close(r0) [ 1720.324248][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1720.330173][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1720.336280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1720.342033][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1720.442134][T18384] binder: 18380:18384 transaction failed 29201/-22, size 0-4 line 3201 02:03:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x60000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x1, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x90e0) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r0, &(0x7f0000000100)="97b81519eb43e5f64f48fd8e244aec009f1afdfde80267fd7902e55fc60c6a47db5bf49fa3825e049f24393ebff94a1aba655762284a39dbfba41430a6eb32bf382104ebcafe7b177cad430abe921505152a866b344ae933c36279da1016114a8c65b9d74ec0db81f004c2c963083a15c3e832497654f534849641c562d3", &(0x7f00000001c0)=""/230}, 0x18) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) clock_nanosleep(0x7, 0x0, &(0x7f0000000340)={r4, r5+10000000}, &(0x7f0000000380)) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xec03) 02:03:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0x40a85323, &(0x7f0000000000)={{0x9, 0x5}, 'port0\x00', 0x85, 0x820, 0xffff, 0x4007, 0x400, 0x80000000, 0xfffffffffffffbff, 0x0, 0x4, 0xffffffff}) 02:03:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xfdfdffff00000000, 0x0, &(0x7f0000000300)}) [ 1720.656016][T18404] serio: Serial port pts3 [ 1720.661023][T18407] binder: 18402:18407 transaction failed 29201/-22, size 0-4 line 3201 02:03:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x800e0000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:45 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf000) 02:03:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xffffffffa0010000, 0x0, &(0x7f0000000300)}) 02:03:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) write$FUSE_BMAP(r2, &(0x7f0000000180)={0x18, 0xfffffffffffffffe, 0x6, {0x1fc00000000000}}, 0x18) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x8) dup2(r1, r0) 02:03:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x80350000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf003) [ 1721.055765][T18418] serio: Serial port pts3 [ 1721.065990][T18422] binder_transaction: 3 callbacks suppressed [ 1721.065999][T18422] binder: 18421:18422 got transaction with invalid offsets size, 4 02:03:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x81000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1721.105916][T18422] binder: 18421:18422 transaction failed 29201/-22, size 0-4 line 3201 [ 1721.134957][T18418] serio: Serial port pts8 02:03:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x0, 0x2) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2000, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000080)=0x2, 0x4) close(r2) socket$l2tp(0x18, 0x1, 0x1) 02:03:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x2, &(0x7f0000000300)}) 02:03:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x86ddffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf103) 02:03:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000006c0)="0af51f023c123f3188a070") r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r2, 0x800448d3, &(0x7f00000001c0)={{0x7, 0x4, 0x1, 0x0, 0x3f8, 0x4}, 0x5, 0x5, 0x10001, 0x101, 0x9a, "1f5b30f1ab0625a69c5df572d34c023f23786d8a8845d6cd2329280ae36b9d3a15aaf2c437ed6fd0c755410c4f139c4ec1d709a561a4a2bd87dbc2b28b37dca07a057ee9daaf8f0599f447444a22262a648d9d77be373eb9304fcf5f8ceb9ebb89bfbc37fd672612ef2aa11ce1d04c4d79288a5787fa89913d9726f283dd5e1f"}) r3 = fanotify_init(0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f0000000000)={0x40, {{0xa, 0x4e23, 0x3f80000000000000, @mcast1, 0x101}}}, 0x88) r5 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000fd0ffc)=0x2) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000280)={0x0, 0xb3, 0x8000, 'queue1\x00', 0x10001}) readv(r5, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r5, r0) [ 1721.515884][T18442] binder: 18439:18442 got transaction with invalid offsets size, 4 [ 1721.546235][T18443] serio: Serial port pts3 [ 1721.550754][T18442] binder: 18439:18442 transaction failed 29201/-22, size 0-4 line 3201 [ 1721.604369][ T5] binder_release_work: 1 callbacks suppressed [ 1721.604375][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1721.633509][T18452] serio: Serial port pts8 02:03:46 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88470000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf203) 02:03:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x3, &(0x7f0000000300)}) 02:03:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) lremovexattr(0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, 0x0, 0x0) geteuid() mount$9p_rdma(&(0x7f00000002c0)='127.0.0.1\x00', &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05604, &(0x7f0000000080)={0x2, @pix_mp}) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000000)={0x0, 0x1, 0x7fffffff, 0x2}) r3 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendto(r3, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000000000/0xb000)=nil) 02:03:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x4000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'U-', 0x7}, 0x28, 0x3) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000540)='/dev/audio\x00', 0x100, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000005c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r3, 0x1, 0x70bd28, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x24000080) dup2(r1, r0) [ 1722.036358][T18462] binder: 18457:18462 got transaction with invalid offsets size, 4 [ 1722.054993][T18462] binder: 18457:18462 transaction failed 29201/-22, size 0-4 line 3201 [ 1722.066131][T18463] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1722.085293][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf303) 02:03:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88480000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4, &(0x7f0000000300)}) 02:03:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x40480) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1722.215889][T18470] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1722.254540][T18480] binder: 18475:18480 got transaction with invalid offsets size, 4 02:03:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88640000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1722.293970][T18480] binder: 18475:18480 transaction failed 29201/-22, size 0-4 line 3201 02:03:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf401) [ 1722.344414][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1722.353544][T18486] serio: Serial port pts3 02:03:47 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendfile(r0, r0, 0x0, 0x100000000) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x202280, 0x0) ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f0000000080)) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$can_bcm(0x1d, 0x2, 0x2) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x5, &(0x7f0000000300)}) 02:03:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80002}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x4}) 02:03:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88a8ffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf403) [ 1723.037299][T18501] binder: 18500:18501 got transaction with invalid offsets size, 4 02:03:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88caffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1723.080538][T18501] binder: 18500:18501 transaction failed 29201/-22, size 0-4 line 3201 [ 1723.093597][T18504] serio: Serial port pts3 [ 1723.113560][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf800) 02:03:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6, &(0x7f0000000300)}) 02:03:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000000)=""/21, 0x66}], 0x1) dup2(r1, r1) 02:03:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x400, 0x0) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f00000000c0)=0x81) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) open$dir(&(0x7f0000000000)='./file0\x00', 0x400000, 0x80) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x89060000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1723.291490][T18522] binder: 18520:18522 got transaction with invalid offsets size, 4 [ 1723.322934][T18522] binder: 18520:18522 transaction failed 29201/-22, size 0-4 line 3201 [ 1723.347175][T18524] serio: Serial port pts3 [ 1723.367393][T18522] binder: 18520:18522 got transaction with invalid offsets size, 4 [ 1723.369489][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1723.419256][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:48 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9b06000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:48 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf803) 02:03:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x89ffffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7, &(0x7f0000000300)}) 02:03:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(0xffffffffffffffff, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1724.045469][T18544] binder: 18538:18544 got transaction with invalid offsets size, 4 02:03:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xffffa888, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000000c0)={'nat\x00', 0x3f, "cc378461b8785951ed23767034c33222f2f59f3968e8edbaa41765e98dc6ed14ebe57906f62767ded98954bf5999cf6687330dd44c9ffb0186ad61d6e7efaa"}, &(0x7f0000000140)=0x63) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r3, 0x4010aeab, &(0x7f0000000080)={0x7f, 0x6000}) 02:03:48 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf903) [ 1724.092027][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1724.102579][T18550] serio: Serial port pts8 02:03:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x8, &(0x7f0000000300)}) 02:03:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x10000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000040)) dup2(r1, r0) 02:03:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xffffca88, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1724.164218][ C0] net_ratelimit: 16 callbacks suppressed [ 1724.164224][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1724.175712][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1724.181713][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1724.187499][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:49 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfa03) [ 1724.281779][T18565] binder: 18560:18565 got transaction with invalid offsets size, 4 [ 1724.323259][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1724.484240][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1724.490059][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1724.495929][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1724.501707][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1724.724330][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1724.730182][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:49 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xffffdd86, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000180)=""/150) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) r4 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000012c0), 0x80000) connect$inet6(r4, &(0x7f0000001300)={0xa, 0x4e24, 0x9, @mcast1, 0x9}, 0x1c) keyctl$invalidate(0x15, r3) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1000027e) dup2(r1, r0) 02:03:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xa, &(0x7f0000000300)}) 02:03:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40, 0x0) ioctl$TIOCGETD(r2, 0x5424, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:49 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfcff) 02:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r0, &(0x7f0000000040), 0x321) dup2(r1, r0) [ 1725.032745][T18583] binder: 18577:18583 got transaction with invalid offsets size, 4 02:03:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xfffff000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:49 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfffc) [ 1725.091284][T18583] binder_transaction: 3 callbacks suppressed [ 1725.091301][T18583] binder: 18577:18583 transaction failed 29201/-22, size 0-4 line 3201 02:03:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x16) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x800) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYRES32=r4, @ANYBLOB="1e0106003be33f0040001f006a0bfffd"], 0x14) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x40) setsockopt$inet_int(r5, 0x0, 0x32, &(0x7f0000000080)=0x22c5, 0x4) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000040)={0x2, r1}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r2, r0) mkdirat(r3, &(0x7f0000000000)='./file0\x00', 0x80) [ 1725.166509][T18583] binder: 18577:18583 transaction failed 29201/-22, size 0-4 line 3201 [ 1725.166909][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xffffff89, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1725.236440][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1725.340371][T18610] serio: Serial port pts3 [ 1725.395969][T18612] serio: Serial port pts8 02:03:50 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x12, &(0x7f0000000300)}) 02:03:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x19fff) 02:03:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7ff00000000000, 0x2000) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x80000000400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xf0ffffffffffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9) dup2(r1, r0) 02:03:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1fff8) 02:03:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x100000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1726.054121][T18622] serio: Serial port pts3 [ 1726.071901][T18626] binder: 18621:18626 transaction failed 29201/-22, size 0-4 line 3201 02:03:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x34000) 02:03:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x48, &(0x7f0000000300)}) 02:03:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x200000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @local}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$SIOCX25GFACILITIES(r3, 0x89e2, &(0x7f0000000140)) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) getrusage(0x1, &(0x7f0000000080)) [ 1726.293280][T18645] binder_transaction: 2 callbacks suppressed [ 1726.293292][T18645] binder: 18642:18645 got transaction with invalid offsets size, 4 [ 1726.346389][T18645] binder: 18642:18645 transaction failed 29201/-22, size 0-4 line 3201 02:03:51 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0xffffffffffffffff}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = syz_open_dev$usb(&(0x7f00000003c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x2000) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000400)={'filter\x00'}, &(0x7f0000000480)=0x78) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3d, 0x80) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040), 0x13f, 0xf}}, 0x20) r4 = dup2(r1, r0) setsockopt$IP_VS_SO_SET_FLUSH(r4, 0x0, 0x485, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000380)={0x1, {}, 0xffffffffffffe56d, 0x7}) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e24, 0x4, @mcast2, 0x9}}, 0x10001, 0x8}, &(0x7f0000000240)=0x90) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000280)={r5, @in6={{0xa, 0x4e21, 0x208, @mcast1}}, 0x5, 0x5, 0x3, 0x400, 0x10}, &(0x7f0000000340)=0x98) 02:03:51 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x400300) 02:03:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x300000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4c, &(0x7f0000000300)}) 02:03:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1726.992701][T18665] serio: Serial port pts3 02:03:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x400000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1727.025455][T18666] binder: 18662:18666 got transaction with invalid offsets size, 4 [ 1727.033432][T18666] binder: 18662:18666 transaction failed 29201/-22, size 0-4 line 3201 02:03:51 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1000000) 02:03:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x500000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x40, 0x0) r3 = getuid() r4 = getuid() lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000002900)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r2, &(0x7f0000002d40)={&(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfb, 0x280080}, 0xc, &(0x7f0000002cc0)=[{&(0x7f00000001c0)={0x116c, 0x13, 0x18, 0x70bd25, 0x25dfdbff, "", [@nested={0x115c, 0x31, [@generic="ce48131d6ba5b456307318bde211687b71460f7f182bf1411e17a90dce7febb8d8b68066619b90a655102a2d49fe94ed440c584489d1fab62774516d3e5482757520e6dedee5944ab22e0970d323d1804e5095ba16e3666b384a576c4f9cd8afe20ef419e0b729ea75ffbe178dfa15e40c62ec205bda7a4ddc", @typed={0x8, 0x16, @u32=0x8c}, @generic="d2e690887a9e08b7b858ae1c2b9e1d4bc40e11e362ec7bf2a102168a532724cfacbfa04797ac227e87508d15e23f7e5c59c93349b7a48db443bfda5db1392a2d9e185f938fc7baba562532f0952729837009235119d679ede9d96fe0870c086e1493500b23b58247ec7f6bd19b6adfc845e5cbcb5d76d6dc658f74826b8ad429cc699388edfe247ec38d38360d12c4951e68e7b8bfa282030f62ea52b26ec333503fb5a50d6bc86dc102d2ebd5e8ddbe84f33d61383228bb4ad0fb4f5867eda56129406e0f6a2bba620508283ec2dcfe338e16dd8de0178d385a9b90717652b8434ce493a5d4f620c1ece42f193af8f17f53d7686cf1bcb50c8b2b733d18df62e71d8ccb65db26214cf7fd4c229e77e977f3a5f39ac8cea76077f50f2f72a0b5d9b6ef18acf728897d4036aee92ab3a5cd6fd4a84e6429deaf31ed808d2d4cb2084b022b6487b479e27716640c185785a5fe78915f179b861d71545cdc0cd1a54d6558c4c244a1ac75506acf6d8b3f285b49930409b25899b456cd84eb5684ddc50a3bb6e0b868a8924cd07aea6606fb93c0bff25aba9aa6984e39d299a36ee2d3f67bc70a45ad81e99b2a9cc1521bcf504e8e1f895856c02b31c755dbf33c3dd6ad79b996d58e59c45c528112d213277e0af575e8deb23fd8ceabbc7e6e35f5bc169f7f59ff26260c51858dd2908efbc511cccf4b7e8a7787238874d56f4a231fc9516b55b0fe14f9955d2529658c30d025710f40dbfc0dff2bdd9297d5cd80594b167773e9196361765a5b7b67bdf7212853c7c88f051ca25df860995e2971bc5a69ea8d5ac615fe0a0c68ce6ac4ecacc43901fbabf4330ed7188f5b42c42a6c3687f23068cf54dfcc8d7ffbf95895b45e48bab03d3642af8cdabdf6925aece7fb902bb02b31dfea426bb0c36ab3dea7f853f25a6e6cac676daa81b41494a414f3544fb91474f1cbcb3fcefac326dfebf647959e8433975a597cb2a8c9c13063a059b2d40ca0433f970363bfbbbc8223a178d7306cb1f3e839dfbd0be6fbdf901293e3740d5c76cc1004b9cf4304545da3cf5f21db023688f6a438fb95c3de3b7bb7d93b14ec4c795a0e5d5cb32dcf165d2a8a9d7e6c49e4f5e5b58d160bed5a109481796c965f1308531b5474d3000e6f29a4578a7752befc07cbd2cd20004405bbf99bbfb0c709878c129a914fa9c593c3d6dc4910d3a02a7e4a80aeccac09398f9fdc22cc402a0b243b2ed22b3c1d122922bbfe0f2fcbd4dbbdf29bae314ca377f5b1d8c6b383e63ac3e8a937275bbca3de90da0ae011d8c2f9dd101cbc2aaa23b8790fe74f247ed2b69a0b9a3aa38c85b467559a926320271cdbcb69734444ba0ad94031a8e8c428e93ee8f21c79f7a462652ca6559a0d1beeba4498818d5e58598f98144440b8b3c92412e18fa05004ed9d0fb3f5c505e39e5c3d25d84bd96bdaa4cf5cecd2b393658b1765132cca9a403292d5187e41afea5199f0037c9016c05f2cd730a53776f787a13e89f750867d5f2bab6e2dbec4d28a8a699017aeef82a37eb083a3448ad95c60c8e51211d40778263637ea92fb6281e5b56f7216ff1887da5e0a68fe4fa7af0ddf9cd27b48d07bd92fcc6b089dbc11fb53858834899c0bd46270a626305625b093cf599f6b3f85b7f569117c46d321121bf482c5a6313957ef08eb1d419164a2fdc98064ab1f646d42f5273c0d2df95e3606702a7fb51c36a9795ef09f231533611dd18dfe6b471083e034c2821e7c99d5d9170922558e960c909705bddf596d233f7ae050b2c7fb457cb2ea3a67ddb9b6f583f59fbe0111007fc004d4dd61821c11ce936e095ed867b7454e653c2f4c47c9b4867c6f4dd2d514af81a46fa60d1b13a5f567462d111fc06984f482de8381cf9c8a33fa8abca1787e327793158edec733e60e105ea6b4397a487d866f1f3e0460c9ea101b6473af91f8ef5715aeb4cccc9ca19c96f32443ff4eb3ddbebafa39ad66fcc23c113842d4be23f230e4fc62f5b1d9e0268226206dadf2022345b0d8d5159907fe357efff19e8ee16571bbe087459c837b4a2a90326967c13f304e06021004884231ae6d014c783b00259b5418994c3ab42b66754e39ae92bfc464adc14983b0440ec407c76f866ac8b4c03195bbe8b32f99761d685aff9bf075294dea9e99cac1af4b6afa84a1d57378f3598209a907139ba3649fe821afa9cbf56155899d474a90804f7b6d38a3252168c0c059e8e19cf3286f22cb705eb33e8fa872fd4ff6df415660781d4e1994c013211fa077d0093eb1677e62d1d3d13b6729a09ec0b3e0ba9386ec0dad089dd4336bcefb0a1ca2f07cf1f141e340f005b2305ce25d01c86e24ca7a75463b7efc44f28934e35ceee87f65019990ad7c99741311e4347c5ed706ca65f7864e63ec2bc2e9aa1c112e346d6891ec000fc61be02df7865e235eda54938e821116ce1ecd21824be17f6172fd19759f08893653ab2388a236580e169c0c9c7e90d3425394be4d2c8808673978d5830d43a77ce4a843f63ced210a1fa1623aa9eb633eed3eaab296befd3804a572a707b29b33a97f648402bfc53dbd1502543f0b36e30ae8c7ef54f5e457cd71b512fe8cb43cfafb80c9e3af7778a884bf75e0abc9ccd67e0989c3b016f225bd084bb3842bd34ab69616bf5e78e20abe726c523f3355ed4c36bd0ea81f8b4771d9d45249dc54e59ee8f24b6a58ef78052c7295b0894e0c195726c4298b12e82e8e4f6ff824bfffcbe07cbd2e6e189060fe98782da63c5a60a8fa1ff5922313118012e27ef56ea2f18c8cd4ba3875a1e4ff61814416be7ae7acca9823f417821d53e1425fd0d1c9577b887e0e1e9199b5d2d89891396e33b6a0d462825ddb35370aba8e81b319f32b69d3e634863ee539697411efa91938c4308993bf686b35b0d4cba26b2a948df441bbb61e002ee671a6be1f43b2c1cffd97fed13c73f1a332633b03d2cbfb47b8aa10720539f21bd4382498695569fd2b903cb296de10efc5ed19757b9b3ef52468a7228d71c63d8fb88cec88f7a4c7a4389fbfc67214856e5e5a8d02e9fe4b4ea2bf5a56f2b00b97ed460df56efebda55f41db2d064b17e728f7e2f364c8ddb58c5575ba09cc6848a6ab9d898ce5d221eb81f48d38adc9f7df60694bfee1a4840147bad2d54db699fe8ebfea1bcaa20ec08796f15c29f292d54044c1341c70ab438f289aec633b4c98c9287edecc15bbe1af6cdafc0611ffb66c69460dd2e346c78508dee135e2ff9d0240dde5a044b51514eff762bbab4dca557521b5c4fa66bcb7e7b61e42c0c83f57dcb93a4862ae768d9d3680722b00e645c7a97a066cf2863a34294b8a8eb0cfe2cbd7141e8f0506d7997b6c736af158466740e63a124122cd29d4a1feb251009705d8ba897da0d7fe651fc6756bb036c03e88bca0232b283b5e85042f2987c39d66c4e5f4e7133df7b53eaec021c1a9ecd3c13269f93d6f42f052a5aecfd75d08a2acbf3b46e73f4f058cad2e8a70935a2fc95cd79b6837aadf6d6f436b3c6332a09da1ec2eda420fefda5e1dbf8f6e50d79c3f00698b000bf1eee0d52f1e056af1ce104136c8d207b9b3add491c99c08c14d3dde98f6389ededaf38c6710982e990f8368338b40e67a9a01f54663117f80364c8791d042e9ce286d03a0abae4b998bdf30aba63155dadccda06013aa82b7ad8a04a0dd36f59bbbc71a28fed97fd70017adbc0cc6e8bd910581c2986a5e647ff0074af9d9ec0b20b952acd365693510591efe42cab58d923fd6af871ca2022f6d477dbe5c8d1d664eace7126e5603f1498b9dbb29f978d277a7628dc3c67031bf2dac9124b0fcee31ca9459e54255292b2f948a7a22d9cf639474bcf1d2843eebb560af8f62dd7653ebbe43fd80e2276d237bd408f7715281f5b1c997f034899bed3bd19a9c66e28a6ab4acd67b45469bfca6c8cddb39f83af8bc5716e85e5596eef6c21d48c2c280151d387439924e3210ff84772c2c1788bd844671017a98f127ed35d3fbb950e8b78e44f1d16a9b01ef965257d8da2b525f9675ebf30dcea750dcef365aefc73f08edf9ddd2009579a0bf828da2d097c2d919de6a43c6e4d3faf48392cfc69ec6e7805f9aab3b492034bd5f0dc9e46edb659f7629da8bebd45485bbf9b26cabd4009feedff95b3d78cff5f34bf9c49dd979adcd5736ff7ef7b67d24f55d23c35c0558316f8f9d844f4f33b268bd2b69619cbceca04c823c633d71b758a4f67ace16e67453f6ab3ec7685637aef581a4ecbe9bf4033c099fc8904fa40f677d7581ab7d7567fdb41a7d820079c84fdb14a2ac2b5e99aa3d78af943a160bbe2edfa70ad01a5fb8941d90ddd5361222d470f10b86b192a402ee25ce79362f579a9c5af3f9e778119f1b841f012f44c2d6176ea747fd95c96eaa9c6a7a965e49c7bb00817e9be0dcc21d0fdd18aff7ef0d9c9cd0d289019e203e741296f8216c7dc3242ae9b20d0353494d0786356a0c6ac8940d4a92de1ae288d1b205ff49dcf152717b104ec2c2666a1c80fab610d48e394c3513497096a6e64118ad2ce9e7b58cb80178874c2f36162bb4c3440cb2ee29441e9dc290d40f8e8c9a490c9f73dde5bb0e6f2256d65ddc5b62803b6de53636517d9d0216562518854427b2c5cb5bcf51d3d00a4a072d522a664c789e8739f41de438413bd72f74472a132529c53e0cdf370610a0efd368a8441fb538e48e91741bc6c1ede4f77fd3f08d6498f099275baf4e843175cc7012a1a3812ea0a91c920bbd90d7ad9b3a08bff19bccaba5618122531d79db0f09a643334771974202b4bdd994843e32580b069f36f7bab28eb2b90947c393ec524e73970e254d830580a8715ab4879c44713b3c5931245d528022523c6349b6e37767045cd8240843b208f1fc42cf910dbbf86f3110ff9bce42392ef11c712c2087019a3bceb97e7765d2e0e2ca1213091120375513d351b511c57d376ecb1e30c249f957d584e1b94b5b8499fce1c13230e01d79eed9900b36f06c7cfc72949de87b3873ac89693549fea128404a852409a78a41d6c24b96fa7516a8d0d95c7fc37bdd7ce2552e9fa89b24a65d222b37a619fb77592e5f5ca75a901ab79822bee829273b591a9486e6f6a452c03a1494016145b2e8ab152bc70f80258e8cc719bd0938b9eba7bf480dac81edc7b653bf9de15a3e059f77ea0c84d7394d185cc236e13cb258cc2aa39a396a9becc6821221c8a9c665bfeaddf8798fea6c53a32064726a811c073bcbf9c720e705d1f3524ef1fe62a6a0e008c530a4d1d904eca0ead4a767211e9c379f15c330903cb0a0331ef9bba74b7ca3a14f84ede61d5c61109755a2627e9be5c25c575c525054efe2c8494333c7d653345ca9465c634cddb22b962d4e7d13dd414a39dd13a259d6b695a7215a61162136c185ee577660b1d9ccec96f4c5eb90b59738a67ce067e8190c877defc03ae9ad18bd7b7cbaff86992655685d9064b0da455da771ddb1a7030fdced07b5eae55ab701ef5aed8d3efa4dd9e33a22a0330f0050bcfcbd000f43d12e627f29b39f7f13bd21dc9a1ffb03bd9692239331eb06d345c41d44982fb3c345d4a2f2f48652e9bd9c11b83694b3c449d8670edb7ce9b6096797078dacdf550e362cc268bdee4de499c214da9a9681396ffae9a294c69ec528100b5df8a78a0a9f21d3ad4ef1a85c87c37d8fff13ca2c1e092a50fc4b12a938758261cd9c4cf186c6bfd01c081498bba60834cb57e62422673b0b885c2658ec16ed7008d6225ca72d", @typed={0x4, 0x32}, @generic="75dad9d87bf316a44f016b8071d110210069457afc5532cfa6729a102a3213645d01d179864532b2ba5c3eec2f67b7a04342ee9b9ba047c2591a057b99223b82887671ea33e3fbdf4139df1296e6848fb0a686b89aa826a82195593dc48a214d11b7adc85c3aa3ba1a4408d2c514ff34efc183f0d84696edfd5d3f038058dbfe9fee3678da7cf73b7ed7254c38f6f87732847d3aa38b69db98f45f204bb5180ff9ddec0a766a6f3aab4f15d4787bf0c03e0f71d3ae189ed713416dce93d9e33d636b4c7647875b44484d468fb0c7bd91"]}]}, 0x116c}, {&(0x7f0000001340)={0xdc, 0x39, 0x400, 0x70bd25, 0x25dfdbff, "", [@generic="c24744d0b900f831f0038e5bdc7e897dc5c921eb6bda9fcb92ffe0f7fed10d78c1577c7acb77048b6d5dcc910927b3837e052b3d58ad8f21f7c68af2f27c569724d725aee2ef790e1da91c9e5afde4eec055cbdde5da24d5fc73dc322fc95ddce98c9221f569ea37b89a91eb62d31b837591176d32e0cd2401fd4157d1129e3dd1f2977675f71f37d4438f6bec6a6892802634ca1ea33d5fdb0ee7069035c80555d81bd2917ee6956b64644685d0dcb25424b04aa3dc26d856f56e641ce37a8e22918b898a279117466f10"]}, 0xdc}, {&(0x7f00000000c0)={0x20, 0x32, 0xc01, 0x70bd27, 0x25dfdbfe, "", [@typed={0x8, 0x2e, @uid=r3}, @typed={0x8, 0x7c, @fd=r1}]}, 0x20}, {&(0x7f0000001440)={0x30c, 0x3a, 0x200, 0x70bd27, 0x25dfdbfe, "", [@generic="4822fef4c12bf016a21153c78c74b0790dce2b69ddfbae79424f213351f168352a2b92e1d9179ebed32f6081d53adb8ffb8db1f3c1b7a412d80cabe14c20307315c054b483003f38b6c20886389ab9eba3390c63fc84d385c9ef8e6da001873fbe1128", @typed={0xb8, 0x36, @binary="7b75c073f6228cadaa801cc1d411e0fc576556a80a4212bd3f76400cffce71bf20757efb4bcb158082380dbe58704cfebc3193b9f98669f4323cebeec52d4441d61f183425d76a024567c219a26f6f5bc0335b5af65d54bfa616ce394fc06cc3cf7b4dbcd13bec431975db5dfb5bdb1837f33e64799b2b481ce6da6d2ae8527411d386dfafe2c535d4b48713f4a9469269760be1d518234989f8c7b9a06ed810aeaad7d2c5b152bdcf09aa5bcaa3898b3b"}, @generic="6b70ab0a3c7ccd19055c4d8ef5cf85ae503722e3600618001981cd6ccc9389e98d714b356adcf9f717bcececc372f6b752869078008f323dd3fe3c25264970ca158aaf07518af52ce71a30237e0649041bf0c1cd947834fa5acc2335ce25915fcef4077a6e004bf9a6af36b6f9cb4189d7d49fefa7cc09610269b8a878ba066a5e1ee699f514507bf1393e70ffb973ea8b0b24a7", @typed={0x8, 0x40, @ipv4=@dev={0xac, 0x14, 0x14, 0x1c}}, @typed={0x8, 0x81, @str='\x00'}, @generic="32a1cbcda7022f34e09342a2189e983e252501d881b46e2d62a3805d16ba6aad7264f7517a69ba80e45e15c265a90715116095530c3aea43138c37f5d0029fe8ca91eae5662e1132851a47d6474a5e89799c5c4ae61da8555633b0baaea6da333b4631cd1e0b405c0377b346fd6697c5e2236e99aad6a91a8fbfcf748ff7", @typed={0x18, 0x6d, @str='em1%{eth0nodev!{lo\x00'}, @generic="2ade328f80a0c3d8b5cf95a7b3305cd78420869919527bac2d45c7e0a9ccb91ff50cd713d7a56ad5909a9c22a44cb1c66a67e2f16b62e5a3bd1cf2c17e2f11e2e755c07ac5b6129cb10c8a6ec8f1d78da5a7ac3dea7c9e2d709f184205348e7725a4fde865d1548b316f3c8dc778ae2f2b5f57229bd7a6fd7e964dd63de501e65b2aea5248f6569b37923c935089d3b5093580c4ab11ca2eb4", @typed={0xc, 0x33, @str='!em1\x00'}]}, 0x30c}, {&(0x7f0000001780)={0x108c, 0x16, 0x300, 0x70bd2c, 0x25dfdbfc, "", [@typed={0x1004, 0x86, @binary="2b144cb4fb64d7f2be18ef4e96957964f0ccfa0cb9359ccb3b46b0c66ead9d53d3ea48e38ae04a531b74a518bbb185cc667835d358e9620015f086b8c3f2379c017346ba4565f66cbb03f64b73c3e931b3a41bc270727b9d4f1367d8a7a88ed7c148edbc7bdcf417ea43f658128ad84c163f847816fdd8178d0e3dea0df77d2fbf3dee82375c99af27abebc897d420d5ce3bd075174ff943ed9031dbb68d9a28e505827f188d4945f018af2721eeb8d4bed5f758ec72664f91196dcbb8fff4deb8aa6a3858d699757c4617ad5766fa7dd4e59c89a8883510e7c8f54b0eede7fa59d86a8af231f96ed2b2a0e55fe84d78ecd04b738b3a2ee5966d78ff1998b7a9edfcb1c3245175bf2284e72c7f6e2ad9ef165860413359a8f55d01badf817be09202ff7f27000ce4169acf2a62caf783717c409f163a9bf9faf6a7e15eed7fa4d7a7d4384a0b305f66adb569db328be273ab8ed57915d9866342e0ea57ffa30681e88a8bade8f0f2446b264bd271f13d8df43e629523ed2d4035e4a28190635bb363e91ea3f43067972ed215a0dc8c24e2f099c50757e232c97a2797f5dd9c007f9af4f06b23260c1b92fa066b5029bdcc31b748e9806f3ab053fd53e53ee17952eee7d9404232e014472b097cc48962a7a981f7dd0082d660f9e5451df77f3c83087314af4c851d75b91d807d7e2a75c1d18699b551891c09a9589d63f63523b6d1d232ceb524802d8dc31436acd44bf977d066cd5ad1396a334e16e05073d9a65d5cf56a2bbf0e1f0ecb23d432d824163d61eed77c342646d6d3b59f59025aa18264f96fe5169ec487ab48478e71c0d4b66e10eca483ac3181cc8f41a8e7b7f7c060893a5107989e52907780d16393d37cf543c149b42c39f53194f96fc4c528d6d7c843df7709a2e64da054065dcad3e837420706f545571ee79608d8798e9828abdf2bfdc49e36bfc69a5bde0f4fa49a5d6463e7c17620826ba1affa27eb06b9ed3324dd97597ea6ab0fddbd8bf7b9d767fed71859c0ef51323801faf348a0952cb85477afaa824bc17d193dcd4d78547e8b63a88f72aea794d30e18a6107b43509f26fe977a34b9d17a8c1ccaf3f8ae2abfa43404b6999a587c142b8a8df563af293c66cf4e8082e1a67ddacd48bf43e7047e9f3ca7d6145ada10bc2c32fd80c75420d0eb07d8e6bc339decd2ef2aedf5ef349ecaad0b3d86c5e0ff375ebd857a93616163a63018ad4cfe6b81d6cd4f20a2bd94f9fdf69f0c70f8fbb1f696d2fb1c44cd2ecbc6081f935ff0f235426876ee02ded871ff4ac8ac8dd3aa3571a821814d37655cf30d88c2c993bbec3a27fd24f4058327e017a91d99fee591382e250a4d53da05e147ce3d13a137b5df441c8356120bd88e63492da040193e5ba2f50af2077ff1efc266d3158e1fd639395b331036aa7825a9e3b65ab53e4ce86d44e9ae8ab5ab05a8ae002337d57241328c3a1f963947cd320cb6b86d951de2e0886a01d71518fec5a4d5419d8e3236765b8c29bf3d2f4866c7ff9dfc1751503358965103bdb160f395d7583a31ee04841a7ca5a9edf4b030842029d30f88c0fc1fc4a5591ef83acf52bd71b54b30d58deb47ed339bceda7e2f8d9c7245283429458bce7ca2180cc1c2e1a2d11fc733f7c1d39978f375a19abebfed624a94b7a662e6d3197c9df9ab92103afe937febe0b90d25d1e497debf9cc96bb04bb2ad9ab03876fc9d2279708e29effc92b80d2d71e754027f13fa12dcc7acd7675f8cb70c5f63ce1cadbfdc039d33fd0bed2792e5fd11e74dd60fd6586fac8f1cb8fee4198731d4d4e037eb443e956a05e2e645d2a7d16f01d52e704a5efa4b23dc2c2f66b018b7f0b7ee7941ea7344644ef549de5f825b98056931fea6cf35e62ec8622faf04d86ac07b09e3e03d6b498fa5cebebc3ee1756b59f5c6a3effe4aac315424417b3c2321ad81aa103cf4c70837ebbbc4f8a90fb892924b66e8fc42409485b628aebd821c50bb25ac686aba046c1b2ec32b0a23782d669bd39dcf031d48fa4be1a3847fcb5b5ecd5cabbf517582ad9696849ec687da7f707310715d510466731a6e897714af8b0c9a35ed861801ce3d6dcc6ffa93c286e18725a0f3288b094ab6b582cd461b19a63bb79f0da9c702a60f3d3b401cf787889070de327c9548133235764440e498992203677c57dffc090e8cb5fbb5f8e109dd3c7afb3d110c4f1ffbab75e31dfcad5d003201022048b2bcc3238f7f1b37a7e22b8d82bff1eb54d166024d87c7d0041434ee0b1f6824963fe6ae518f6a5ec03e967bb732fce9b86d46f38c7b1407f5eadbc4718cdfbe8f43d7b584f153b937637dd111a9e9bf55bd9b0ec20d7d37678d03762e79b7ef12e0e7ebedca8217bac3a87fbb0a37c4b180c6e8bb836cc33ef30ecfbd07a16277f18a917830fce07ef72fbb481271a1713cefa29600572c3ce2285ba233def0ad614e0a585293de19a80c7a15ba4246590bea6e880654856884584568261f4cdce32ea8f76fe0d9d8939d0234c5502ae87929bad939c78a97c28f045d1e5c4e553904190d2200806104d24e1929f28f347f0a2ad87526860bf8dace33096b83f3a3227bbf6ff5f9c3593567918dba2da7158bdfd04e5b1ed5dadf367aa952d6e865b8b4d95d5d2040b0a351a60a0481abc813bb8f887bae9c55a99c5d9d77ce918add48c9baeb5e66f036fea09dbc456fa7fbc86d736b95a4aba8e22006f2c71ed81933142c3e7cdd37c2e9a5f7dce79f16b951ac68d466f8f72ef20f60d9f580f0613c54157933672df2597cef5cc5a4f32eadb326b2a7f1bbebf7c37ffd2d656ae6ff5a2993a39325de6b9c36b895185b1ed026a80db98b8213c67f81d6710984150ee7b66df05805535c62b0216a2d8068ae7453cead368452ef78b672e7c06c18ef41b3b838fda734ec556284d069c4c37c2ebdad0c1b97f159661af72ffd01ef05bd9afc070e3099cdf6be12b539a826f0c1da899c357bf94311598f603ce551cbfcc8d6e4af45b912b210f266091edbfcf4bdf5f642431720a885060d8f387e0f70876a848cd9d0a5da6faac7ee8c35522be6b699bc66223701c1e66f0232ca8a4788aa1277cf382aa211f2469885da66bbdcfd43901226ce090d1b722685c40ae116c795a58f72e5240b4a9263c7e4edb7691d6e1e43f264e55badeb097ca9b29e07e0ea0b6e8dfda0ad3e53eb0179a80dd860fb30969b0de45426ca7600470b9ba8c0c87c3301cfd1b74688f1cf6dd192537aace466d510630413995bb811e0df71334ca4653f9b01ea58e323b00faef099e0f51a2603d61f34523231b8ce1bcec19cc7b528120714a960513ae870770c121f648b667501f4150bef9968511d5fa1b4622fd27d2d08628378da659f2b05c3526da73e4a17310f5f489f0e38e91ef43e56fb159230499a153b8d9a625684960e757d67a704ae46f29e6a1108f4c121e079f2f2ceb4c5bcee8e848d129bd9a3a77fec5705b3d4f4e8dbab5139b3c319fd3df33463ccd80e8fc73b3a4054925cc464ea4e2cd0839cdadc1c4010aea7a3c7835e54419302a2a11c9204441626099c8496b351ad0493745d2c04358dd54c543e32f2804104c03bc5e02f52f3746f0fb9c0ab26102fabadc778520bc2e60b86e1d9d6c051ffc0c9b78c8965c40791182408905d031bff17be4e0aaf6ad7833c731af9919f0dd7ca6b8d4f89f5c3dc7a2849c8ef9189ea1a69d54ff6572e7902786adec3d7b11580396f0116c6702d4febe782c2f6e47b4a44e4f355e1debdfb4f15db2a9f7ab5dfc80c628a66a7cc005aeeed6ef84b41ca133d7c9f1ff1809d1ca616349ec3c1fb2b479001c9cf4bbd15f4ec35e00e541d2b73d6590e63af8856c5a669b7c3c75af1f9874e2e71b8103f810b540c52df1c1fffb94ab1dcfde0513dbbf3063f2e63c96952923b955e3c84ea818c4355e811a34e5d8f8c9fd01b1453cfdef4bef6da0de3076af06ad28fe55058c18a4e2033624ba53933093b04b44833914a1c7a3e108f5d40c32b0379a524cc3ba5adacabd333363c04cbe77c2393958dfdb0595203bfc7b3bc42387f6c0ab60675f433a1406bd45b249e84a4f75b4b97c148d0720b39432088aba826e7df3fef26dbc5aedcf180e2f637a47af451261ec3e03c5f6ef4f3a1467abfb3167519b24ad4cde71181db7e59284494b68200f582a1ab9204fbadf4ab3210e429831c1728b4ceb0959399ae606b84adede872193d4292ccf89113015ed2b51d2f950fbe9ac7220ffa0031716d22af0f0b55133c9ea7681ba9ba6110ce47ea735eb8e5bfa24c31ccceda7147545d75d82e76b83551ff4377963161f868304750086b5882b3e8a7d1865f1cbb2d0967108319b3259998dee76e9c8cfacc8fcea0ef03750314e6f7565a509f0be766f386d8f9665f3d484ec83ed8784d620e686b12d7e542919125b77f07f55488089777b15f8bf70b362ff9826fbec7d094ad3d64a2825cc76cf697eb5d450506933289ffbe9f91eee7a57d3b665745e9884fc98284ae2a39c2f7fbad78a45e79cab633ce1007b8bf219e3875600ad04235a36cde7e72917e6cbb156854f204232535894e0746f4c93e35081f96aa5f1f8eba6f9470aa68feb98cd6b1ebe7f4e01cce04320bbfaf3850a7eb1c5d8a98193a230afdf9c30c87df717c58265981014fe4071975ed838263485d145edb3b179f1a8acc1bac9844a51d6fea6c8b705b18b89d16afd510467a4398ca0ead4b2ce61aa7918e6dbf7878b4fde628e63dd6c9701fddabf77b43434ac0bfade2daa046a277705985a9b42659f2179b6705ec332a7dbee1b5d901886b339a8672e6bf5b987dc70a2015462c69914528a8f1d10c9962869733cd7941ab0626489d0830090dd7aeccf9453e9a9279b171a25c11d004735d1712acdb9315fbba742b60a0b249233d85177dacf3c3dea449bc2f6ec6d99ac8291533da4edfc74fab747bafcb4b1c688ef66dd08fec11faa079a096c409afc0bb8e6d493a18facba58c2d6fa0cfe47a4cbd0a830538b86df7dbe3c15dced98cfdee46ad32727578051a05b312340d8b358c16385113ddf0ad0d3ca69b4c08723f34eadbd6721501fe6ee9421035e732266d70d769893e99fc7f1b6edcf525fca4cb0c67e1935eb74838b584c13ccfd8c26a99c87510189b30f43637151ed1ee298fd7a9f89def237893d035338433e9176368c2a859f192b741a0ef266b1b967b30baae2413d82ed12275819fac8866fb9b48b470980656c554856f2390e6d0142c368d8c63d15129be056b7a3c164a435aa43d014a9402b0c9b3693829fb82c87c22b3dced464e62118cc31c043d3d4a85dda0d0e6cb2494b17b0fe1554bda071fe554750c287752e66229e68d8c336ee6c7304035c5726f0306f725d39ef481047d2c223dae1978c81d1864caac58fe8f6db26948dac96a093d2be99b8315d12956546d5932749a0c2ccb610be1781ca833a367ac2400e8f24f05101568f2f2d5a6c17f55a59b2395995592e6f31fbfb152ebd85dec8411c93a0469c85544c546edfc10d22477766c0bd552a0ebec9ac2d37cc668885caee9efe8edd19be2bf27aae2054124ff40026d860acdfdaa043ba9326322fa01150ff93ef1bf89345d77de8bfe3157b339a0f4cb119b014056bee15ce67e7a6cb92eab3895f7fbf8001c5b2ca934e41a7596880e01b5f106a3dec34e1c6e326ef654e2985c7e8bd57017fe1e4bd70c13c29de2851cb80318d34c5d7fe7efbe9919aef8332d59eba3461bc15a453c"}, @typed={0x8, 0x3d, @fd=r0}, @nested={0x48, 0x5a, [@typed={0x14, 0x6f, @ipv6=@dev={0xfe, 0x80, [], 0x14}}, @typed={0xc, 0x33, @str='wlan1\x00'}, @generic="cc9d068af16dbb6278c98c1562efd5f5", @typed={0x8, 0xd, @ipv4=@local}, @typed={0x8, 0x11, @uid=r4}, @generic, @typed={0x4, 0x9}]}, @typed={0x14, 0x4e, @ipv6=@dev={0xfe, 0x80, [], 0x1f}}, @typed={0x14, 0x92, @ipv6=@local}]}, 0x108c}, {&(0x7f0000002840)={0xa8, 0x2e, 0xc, 0x70bd2c, 0x25dfdbfb, "", [@generic="4c9ef73f549c16cc88a86fd80aeae3892bcf2d68daf9d6a2f3008a64debdc8e1125c68de03859bc79c5b1586ae7a1d4c6d365d8ce862f59d04916bd58245e5e58670b9cb6fb6512dd268480c0515028918440ad9eae3b841e8571f1a727044a42efdea58c3a4da3fa0035139dde23dcbdaa02eb18e5e364f4509626b53e8303cdd5b4bd23ba25d562c38b9f49b5ec3e00a31f1936ff269", @generic]}, 0xa8}, {&(0x7f0000002980)={0x32c, 0x2d, 0xd00, 0x70bd29, 0x25dfdbfc, "", [@generic="cd381740fbdd4266e7bc8c25b52730eb9843625ddeb07e74b204d32fd35427055613db51791a9e3c1586c7f797f6f17e6811dffdb618b002306f4f8853c8fc7ae8b246eb0c74d0fd83d1045d928cf44f27c08d43f4b3452aaad5cf24eda3aa2f42813251dcf07351b058aba03a064be444aa9b079ec99c907c77c850a8e090ef0a5df6b3148aaac742cf1942fe4f44c9a10e0567725c141ea11742e0d72566c0695d25fa170257af6a6b3ca44b591602f789f5b4378b603b92d3436fb8637dcefc90a54699ecfbc7", @nested={0x15c, 0x8b, [@typed={0xc, 0x2e, @u64=0x9}, @generic="b18391e26a048b564528006e94ba73b7714c4fd1d597f6106b9e197dcca026e29d7912ba53a632a4eb374bfa65bf5626b5e6b96ceace9964ae0d716aec164f9981a153857fa1d9bac5c2e268cfdd6867db0a7331a5", @generic="f1a2ecb52aaf56050c0fd46ea4615d8eb24d5ac9bda4e5028ac00975d65cd53811cb043dea9211f6075a6885bd00f1a98b4e9a0aac07fde908f09126b419fbd03919b7271ecb1a620f1318c045193e614b6a56b1e3a0307ea8442588d91bb8393da4e1e06d97add74b67fe022a42120d3fff60960b5126857be115784b7d980c295c9c9dbe2650cabd3ada59df407acc454be0c39a9536b26f6f40adb7fa7666c0ca216f4082da61d61f5414dd7b1fbe307954339f995a2f6f24f4d686980275af08cddaae35bdc5f14f2e8c9daf3725c1f9fc4fcd11aa884df16242f731027e7727d9a95091f70f1b50457c4cf5ff8af81e00db"]}, @generic="9ffd0b1fb4caba24a874f865633db6abfb7563cde71cb7f4a41d6d8c94066515eb25c7d1a43316e2d8477b1b93e0fe9fc344f1a8c502fc11fd68fd6347a04871c2757b0d6c58ecd446d091a4aee6fe811787440618edacb1f2c2b882c9071c8133131244880fce6c065ec65209f7ceada44ea6c8f68d37ae452d8dcba16eb18b601d7511d4d24f2fb6b86e42e2c85d2e16f8cc916d23ecb79f580da14638c5c41a664db6512130e95a5c34553db94da9c15c36b10fc7faf9c5ab8a6b2f74a7f53675f5c06b57bd534525f1e2b2599ab0", @typed={0x8, 0x57, @uid=r5}, @typed={0x8, 0x8b, @fd=r1}, @generic="c4d648a5265ce89539891a695b114e2ca4a857014c"]}, 0x32c}], 0x7, &(0x7f0000000140)=[@rights={0x18, 0x1, 0x1, [r0, r1]}], 0x18, 0x44010}, 0x48000) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f000000b6c0)=[{{&(0x7f0000002dc0)=@ax25={{0x3, @rose}, [@rose, @bcast, @rose, @remote, @default, @default, @netrom, @default]}, 0x80, &(0x7f0000004380)=[{&(0x7f0000002e40)=""/249, 0xf9}, {&(0x7f0000002f40)=""/79, 0x4f}, {&(0x7f0000002fc0)=""/34, 0x22}, {&(0x7f0000003000)=""/172, 0xac}, {&(0x7f00000030c0)=""/160, 0xa0}, {&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/120, 0x78}, {&(0x7f0000004200)=""/141, 0x8d}, {&(0x7f00000042c0)=""/129, 0x81}], 0x9, &(0x7f0000004440)=""/92, 0x5c}, 0x2}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f00000044c0)=""/101, 0x65}], 0x1, &(0x7f0000004580)=""/83, 0x53}, 0x8}, {{&(0x7f0000004600)=@in6={0xa, 0x0, 0x0, @local}, 0x80, &(0x7f0000004780)=[{&(0x7f0000004680)=""/250, 0xfa}], 0x1, &(0x7f00000047c0)=""/248, 0xf8}, 0x2}, {{&(0x7f00000048c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000004a80)=[{&(0x7f0000004940)=""/70, 0x46}, {&(0x7f00000049c0)=""/188, 0xbc}], 0x2}, 0x200}, {{0x0, 0x0, &(0x7f0000004d40)=[{&(0x7f0000004ac0)=""/252, 0xfc}, {&(0x7f0000004bc0)=""/146, 0x92}, {&(0x7f0000004c80)=""/179, 0xb3}], 0x3, &(0x7f0000004d80)=""/4096, 0x1000}, 0x81}, {{&(0x7f0000005d80)=@rc, 0x80, &(0x7f0000007100)=[{&(0x7f0000005e00)=""/217, 0xd9}, {&(0x7f0000005f00)=""/126, 0x7e}, {&(0x7f0000005f80)=""/4096, 0x1000}, {&(0x7f0000006f80)=""/173, 0xad}, {&(0x7f0000007040)=""/147, 0x93}], 0x5, &(0x7f0000007180)=""/238, 0xee}}, {{&(0x7f0000007280)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, &(0x7f0000008780)=[{&(0x7f0000007300)=""/39, 0x27}, {&(0x7f0000007340)=""/4096, 0x1000}, {&(0x7f0000008340)=""/41, 0x29}, {&(0x7f0000008380)=""/135, 0x87}, {&(0x7f0000008440)=""/73, 0x49}, {&(0x7f00000084c0)=""/230, 0xe6}, {&(0x7f00000085c0)=""/144, 0x90}, {&(0x7f0000008680)=""/198, 0xc6}], 0x8}, 0x8000}, {{&(0x7f0000008800)=@xdp, 0x80, &(0x7f0000008b40)=[{&(0x7f0000008880)=""/244, 0xf4}, {&(0x7f0000008980)=""/49, 0x31}, {&(0x7f00000089c0)=""/130, 0x82}, {&(0x7f0000008a80)=""/191, 0xbf}], 0x4, &(0x7f0000008b80)=""/167, 0xa7}, 0x2}, {{&(0x7f0000008c40)=@hci={0x1f, 0x0}, 0x80, &(0x7f000000af80)=[{&(0x7f0000008cc0)=""/4096, 0x1000}, {&(0x7f0000009cc0)=""/158, 0x9e}, {&(0x7f0000009d80)=""/47, 0x2f}, {&(0x7f0000009dc0)=""/96, 0x60}, {&(0x7f0000009e40)=""/4096, 0x1000}, {&(0x7f000000ae40)=""/182, 0xb6}, {&(0x7f000000af00)=""/89, 0x59}], 0x7, &(0x7f000000b000)=""/105, 0x69}, 0x1f}, {{&(0x7f000000b080)=@in, 0x80, &(0x7f000000b580)=[{&(0x7f000000b100)=""/197, 0xc5}, {&(0x7f000000b200)=""/70, 0x46}, {&(0x7f000000b280)=""/239, 0xef}, {&(0x7f000000b380)=""/136, 0x88}, {&(0x7f000000b440)=""/89, 0x59}, {&(0x7f000000b4c0)=""/181, 0xb5}], 0x6, &(0x7f000000b600)=""/143, 0x8f}, 0x401}], 0xa, 0x2040, &(0x7f000000b940)={0x77359400}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f000000b980)={'ip6gretap0\x00', r8}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r6, 0x8907, &(0x7f000000b9c0)) syz_open_dev$vcsa(&(0x7f0000002d80)='/dev/vcsa#\x00', 0xfffffffffffffffb, 0x100) close(r0) [ 1727.120672][T18679] binder: 18662:18679 got transaction with invalid offsets size, 4 [ 1727.120756][T30760] binder_release_work: 2 callbacks suppressed [ 1727.120763][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000180)={0x0, 0x1000, "83dd33bf4deaed1ea9b3b3885372c5e89cc560551355f1615fb863a1403225f38674aff23a248fc3f3e6ed937700e8f325906555004789837ed453cf93c9991d7e5e75c5ac7b23733b773a256cb190d12d871f854d982e93b7b42b92886f946e31aafd1e82b703b52d634c55dc7924f47ebe5a3f9689e73b7ac3fba6f12f1c56f5771f4b087a580679aec7e88856d1e37b5c8cdc3ba4f022fb47c58fdd30e752206a3ee67942f2eee93130dcbe25681baf521459f917c26926c2aa5bef5abaa83105df2bc067ff558d9dcf17f6e5e0bec1da0efd6d45585285fd4b626cbf2f6de230b03f2c9b088662b0d02ace82ec0c34d9912ae882dd6a67d6bed965c3164016797f5fba0271c8a7b30699e3a6a7da594e73971389966c93458e33229b0dc928e761a54625d5b6e42ab56f78f3ef861871e003ead244cf54c524fd4de13fc2cf31c5a4cf1ed5f16f6624d3fd2f80dadbe76e08693fe4717d0e17c621e21baeea1fe99d8a4cc0fb04b160307901934ff80088062c945c3c04c46f2ec024842b217d47b0bd2493405b1ef93077bfcff37dee5e56499bec11203fe0240433572f726a7bc2939f6e485b42a5d141cc3815ebd298d68ca38bd590af671aff048d79ce00602edb5c319a5222119e2dbcce09c8bd34171a7b7a09acf836ae4b07aa1b7b0dc4d7c0f61625ddaf39ed44b084f20cad11e8e79eb089aa7948f4bb01a8139e0c93f9cb387ed812eeac47627d6f6018bbdc4a0ae069a1cf2e11839d54eef86a8ccd7e23e729a935f29e77bd0e84ae74431dd4801c7247e95c316e9cff03eddf7c9bd718a23c848833175a16b2639c6e80fb477932bade086c26a2c3679904b80fa6bbf2575d8e2430976b38e7cbb7734a75fdf37cae20b46852a1639ef519c3a7f3c22bbb574f23f258e72fa917a9bb87d248f746a71115afed8cfa10dd4e52f2b30ad26c0f28885b644dd5940584b791efc95ac23226fc87d52d40d53a69c0e9f11b8e9059b838dd04439324f90b382940f6b8c398ab5e4ec903ce4a12c381e8083d927281f3b874e0be051deb267707e9ff7bb119116da23f171e2c03a55c4a948a2bda8c99bbdb55071a241c5865b3658c108da2a49bbc499ba11d25a165f7e69cb10936f73e9f4507697d12b0d379893ac47c3aafa781540a37ec7b67de24834a7089a2d5f7b987fff0890c37c671a68459f60da35a470d7d1d2df27916eddfb54aebfa61910f0609486a42f3522ba7b94589c3f0d3b364b90645b0f39fd5f0bc23c832924b69d7cb9452250d8aa3abdd95708aac1547efa5c96f6be6db802ba267cc3817773982eabb7aeab835c1fb1d4ab6de8c37a021852ff043efa4a02f7a151bbe37d75db84f2fd324336a48f01dafeacc5e7da70cc567174f1b8980d9fd1a4b03f4c9577f40c29e3d90b1e03f51d87f84a1329899e5f25c4c5d90f3ca7d9eeaf97554127480e35642ef78f521212db6af1d4922f5550ca89eeb59c6e241e94128f5c7ac5a77576f27ee5e9a0f00182b13e3ef754e910f13988ebd97504a31daa1175ee16f99bbbcdf8815ef0d6ae820124d4e3fae4200999dab44596a71bcd8cf1f92068e6ffa8d8d0a35f338e996b48cca90a292a45e3663ad7f1fa9caa16e33f9e3722a21c78bf42437bca971d8950f1cef7cd774cb98400589267bc480d1f413df2ca206582c0cda67d6c8a5d522aa41849ddb4552557fa2c8db7dee74a84403bdce0c596cfba8b63a1a9e22f6c33c739f2aff1bee24ede8db5d0b1cd9073af050d68f3c6e7fc10aa35cc9d044c25c18a3b7e47950a0ec908265eb11bde8a70dfd97e66e7af8e104ef80bc2540d110f6fc2a40b4561ec002d86911afb1866fe7fb4e66887906b4d61499bc9a0481ed864490af29c16a33a8d766d7a173991fcb58d03454aefb391096a697ccfc4aec0eba9ef88dc6be613cd3a97a384574bace28a447c9671df1035fa9e67bff5f7d6adbdba22f8c202ef3021b90e9f3cdabcb69d5a9fb2170e63626085a6d46dc1eda7a377c610e43f2d249ba0719fa7b6b07d5767cc8fed8d0077730aad4ba8d754e5aecaabf334ba622c7468c1290cf833b508ba723b09548d1ce6f95c277389918b62187129f1def478c2bd6c1eb285687dd77f6936e1332788b863ba08c64b34f38407c58abda659c8bcffe319c7dd9d45125a2a0f43a5921517d8335c79c74dfad1f1d165fbde785a51efad241fe09e854b5796f887a522a4ac987c09a7ee4ec8f0713cea0c9213d57ed97d7e50776b7dec3d072c7fffae48916b8b020f73b5264f1b526b0fb59c903612436b7f6c040202e1edce408aed931f4caa7eef49204f01dfa537105084bc941ebcfbd275544173653fa9fb30e8d8e111ca81506b09a40b867b90ebaffa3cd77538c47e8f37dbbead1381dedcb07c25625ef3a0dc8ba4784b97d629b831461e2a267ad8aac0755e95ca54dc156db16ff3023c61c9a14dee22f05591342c7f1783a3631ab317c8ae0434f9d93422604359cae57fb444603b5ecc12cae18bc9e064abb728078937cda46d484b7b4cc735374d35347be5d722c6bf5f573dd21fccf6cf7dd0c9f31adba798911087422a04341f0957d72a81353d1679475622d8856e561c8d56e35c21f44814d61d4c49a20bedc99421f1a6fc33d2112b3907d4a74277598c80538ea4a602f1f92ff484ac0866407c8ecbc6a61e374faa40a874343a47c2e5ddc8d5257a6745925dc1ce485dbef51aaae99d5c65f1564d35ce6f465b28f4135d2086b740c15b447ca954a64444fd734f6ae1bb47797f67f299fb13c8e6a64f5dbf15e8e4d209a539ee2be475da1c62af588e3f819e8c57cb558f6a6e924f072e703ea88de5176404a68d04ce581134f86abb40742529390668ce10b4f972ac2021abc7f7dea99fcb68fec48db0548e8cfd37f269a7a1f2ada7c13ff6604a3d7830fe81a4f1c8a3e45ac919191e42f7624555335cd19a7014f004d76052d19ec044f2009e73f7ac6eeeeb4c3f671c67b24a7753e78f05cb2fd5f9398525b59731671401163315b6bd4e2fbcda9ef120da8b3580761bfed0618a4674592c76210b04172e4d06cef4dcf5550ca033ffa134a6c956525473d7b63330a7c5cc1f6c7618d5da53926155eb7e5fcac16d3877c8736f9209bbd100d11cef76e9afb45977417dc3a905ca0a5585b947ce47d5ef6facc0f59e1bf26a29f6824a9161ac91c6e0cbf37f2b89cd409436a134eff2ba00d28bc5141ec0b76e317df23d82d6907cc4296853f60405f9829e306fb89a4f37c499f76fddf861d1017718eaf898ff5f025bcdbcce73b7605f07c44232d213deb61f11820a92fcd053724cbc8c28f60f2af3697856aadea275435e9255c285e3208040ccb13ee93828cf5fe7e69f23e0ea181bc13fca8107f70b3086ca5a218d1899dab0759a5398dd0b167c587fcb13f556dd19173c76128b8e8a9352745d4b9c495434b64e2527a57ab352ccb1469480d8cd9e773a81140fd54c858f60316e1d0509ac64cd9a5db02592422af9c8db571815a50bb4f10565c8e7ed2a2c33254df78c0ae8b01ab2c9c9e38f813db3b834c23b6cd3be502bf83ed009867c477b643d31f4c568bf8bafea81ca29034fda9789dc866f634d60c2d7c2372af6160b5e8f60e1d36df69fe496572705f7f7fe4dbd8ed9797332500ce5ecf3076b3857dd31dd5c49163f0cefc976568139f0941d5ead06997e97a35d5830a4cdb12160ca7b678e918fb1376096085804f1f2a78ef8882f66510a4236fd4d104c651c1128ec71b363327828c9270190d107d2527b9a3edc89297eae61e62424bf4fe2106938b3aea38741761762eedd64f134924d9ce7d83c52bd0412e1aa2a7f2473910bd4b04ca4426a670d496a623b2691a8721e2b4cc22b7ae87d6cf031434bd44400d79e3193dc167b4bea1214635b37473c6c4492c9ed8d0007c67a277f22625a819b249fd0ab64836c9ff4ac18f2e260513e90c4562b543deb7aabff02a0dbc34a3993985770346a4039c171fb746d6779222876abddb38c592c64aefcf56794cf434baacbd3ad28d257774e9f99222913d0b0f8e60666d33380fe56493b4ac32fe262bbc740dcd9115f85b38b6e2df58a32cf5d92a78943c59105b0e25429c74186585617d8320bb95fe845a94bb41e7ce6a930371a92d7308d693462e4d688719d2c497f85f9c210bea2a05db55f0d03d2a11a597229c6b97605349fead465128e699907259ae5c372d990b993156da927a5f017254a51723dc024cc6cb3aa325cdea0d715c447e383e948b10e5fc9aaddf0a56e19eea1f9c67d7488b0a6d38090a0fae0ff05328acb2936e8c5b6e3234f39abca51bf7468a925841c5a610f656aeb0591f07914638dccd6f8db7c22eb6fde9f4d5875aa333816ebae3e99ab6f052d0136b6807d464cbbe5eca0bdac56faa01f591c0f9567a2510dbae704966655c58661a59216bdc55b27699915d25cfc68d22f14a19fb0e396b0b9a1697c74fb1492bb89476dda2cb81bb8ea527774c05fd1c95a283ef19642efa0e19391504a42f256762782a0a6e3fa7e6388f3e71e93b5b81729572a515360517f1629886b61429a0ab98a5cc1ce1a369292635d9aadcffa0177c1e310832605c5b43e5a2aeb09228f5e137883de913c9ecf2f44712957ca55c4363e07b89898932ec9026e8ca42caf900614d893d275cd42e4706868ed5d9df3182434e5986b6c56c2c7e38bddee34c8ccbdc31b60aaadf2d32d90a7bd310cd8f67163cf1012cd2f8d0a7991626b63c3c184454c7a46e575d617a397f6fec3c69833b0643b184efb3f378b9a70cacdaf6c356c5e79f0ad4755d5071a2ba1b5e38d8169c46dd8355c600be084c052638ef1c9726582252718d29e9d71b0706f05909a3edba501107f11bac06b1bb56682fa8678e4e278d30ab76201432908bd495b13af0d3d35b926a8d659da6b0684e03aa6b014dece8f64a05c47b8f3ea134e8f2b6272b06e5059d3e9a5e0c5982c1d3111cb563c61c9d42124f36b1223b5668ea0e1b83186132730cc60baa8ddc427e4e4d0b8165df790229bb378d6265676598c1a1d33cd4a226572da017002e883c68b0dc5af3b70c9ffea6dd392f338863b0a7df7d7cd5e58353ffc318ed30554cc8a5aac702e7296da5b0b1f0f8c5a05bd97f1c9d53aedb8f666b8ae88e5f40641536cf74cf0df322e7e613764d28a3208055ae06ac451acbcb0c00cac1c1aca471b5e30bd49545837cfda7fc218c80db229e06e03b0ced277e7cbaea876f0ec5bdd4624b855cebcd61c5aefc437b50beaace7769fc98d69610d3787b4de9ad407206ed666c64b8b73954f2bf98fa814912e4d60ce8037fbe9ab70ea747d218128abd37e2b9ab0c7dea43987ba2fc05b0ed764bb072df56b347b67f5b1884b48173584dc36950f070e5f602662bff71b4246384119857421288e0cf612e0dfe0d31b5a2443d66fad800020a9fb818aaa66d71e23db64ffbf141ac576f622414c0ebed91f24768c8dacb669540bd4a73b82d432f345034d3b9938d7af4baf1c601a963bd43f927dd2396edf95fc26e91c2a8648f552a947920a020a3f15999b46ffcb20bb9b18c734ca5d687d4db8f5114baada6e437a68d162a1614ceb25ec998207666ab4e93694ea2b8fb29d7c4d89201c41713d07510df451a6dbaa81d71131470b51774d10e34e782753296ab2285560e4dcae9c12ab87642a1f7e5d0ea9ee1383df95f5990a9a871d215ae382c21b6787888f4c19c2729f0f553d20a2bae177b"}, &(0x7f0000000040)=0x1008) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000080)={r3}, 0x8) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:52 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2000000) [ 1727.211527][T18679] binder: 18662:18679 transaction failed 29201/-22, size 0-4 line 3201 [ 1727.249312][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1727.315520][T18688] serio: Serial port pts3 [ 1727.377525][T18688] serio: Serial port pts8 02:03:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x60, &(0x7f0000000300)}) 02:03:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x578200000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:52 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:52 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3000000) 02:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) 02:03:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xfff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = getpgid(0xffffffffffffffff) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock\x00', 0x40000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x1, 0x7, 0x4, 0x0, 0x7d, 0x40, 0x4, 0x3ff, 0x1, 0x81, 0xe9, 0x5, 0xffffffff, 0x200, 0x3, 0x200, 0x3f, 0x1, 0x0, 0x0, 0x1, 0x8, 0x1, 0x8, 0x5, 0x3f, 0x101, 0x9, 0x801, 0x4, 0x10001, 0x7, 0x1f, 0x8, 0x3, 0x0, 0x9, 0x1, @perf_config_ext={0x20, 0x7fff}, 0x28, 0x6, 0x0, 0xf, 0x2, 0x800, 0x2}, r3, 0x8, r4, 0x2) socket$bt_rfcomm(0x1f, 0x3, 0x3) 02:03:52 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4000000) 02:03:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x600000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1727.960093][T18706] serio: Serial port pts3 [ 1727.974652][T18703] binder: 18701:18703 got transaction with invalid offsets size, 4 [ 1727.982712][T18703] binder: 18701:18703 transaction failed 29201/-22, size 0-4 line 3201 [ 1728.055782][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0xfffffffffffffffc, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0xffffffffffffff95}], 0x1) dup2(r1, r0) 02:03:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101040, 0x0) ioctl$VIDIOC_G_STD(r3, 0x80085617, &(0x7f0000000080)) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x68, &(0x7f0000000300)}) 02:03:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x800000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:52 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x5000000) 02:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r1) [ 1728.251741][T18729] binder: 18727:18729 got transaction with invalid offsets size, 4 [ 1728.259969][T18729] binder: 18727:18729 transaction failed 29201/-22, size 0-4 line 3201 [ 1728.313736][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1728.365367][T18737] serio: Serial port pts3 02:03:53 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x806000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:53 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x6000000) 02:03:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6c, &(0x7f0000000300)}) 02:03:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x7) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) connect(r0, &(0x7f0000000100)=@rc={0x1f, {0x800, 0x3be6, 0x1, 0xff, 0x1ff, 0xffffffff}, 0x23e6}, 0x80) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) r3 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x40) ioctl$EXT4_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000080)=0x8) 02:03:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xd00000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1728.906329][T18748] binder: 18743:18748 got transaction with invalid offsets size, 4 [ 1728.944040][T18748] binder: 18743:18748 transaction failed 29201/-22, size 0-4 line 3201 02:03:53 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x7000000) 02:03:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1728.971753][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x74, &(0x7f0000000300)}) 02:03:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2800000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:53 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x8000000) [ 1729.101445][T18764] binder: 18762:18764 got transaction with invalid offsets size, 4 [ 1729.130661][T18764] binder: 18762:18764 transaction failed 29201/-22, size 0-4 line 3201 02:03:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1729.205553][T18764] binder: 18762:18764 got transaction with invalid offsets size, 4 [ 1729.206101][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1729.263002][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1729.364253][ C0] net_ratelimit: 24 callbacks suppressed [ 1729.364260][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1729.375952][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:54 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2900000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r1}) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x0, 0x4, 0x4, 0x0, {0xa, 0x4e21, 0xffffffffffffb2bc, @mcast2, 0xffffffff}}}, 0x15) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:54 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x9000000) 02:03:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7a, &(0x7f0000000300)}) 02:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000040), 0x10) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1729.913991][T18780] binder: 18779:18780 got transaction with invalid offsets size, 4 [ 1729.948831][T18788] serio: Serial port pts3 02:03:54 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xa000000) 02:03:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2b00000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1729.984028][T18780] binder: 18779:18780 got transaction with invalid offsets size, 4 [ 1729.984632][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x1a0, &(0x7f0000000300)}) 02:03:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x81, 0x200100) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000040)={0x400000000000000, 0x10f001, 0x4, 0x8, 0x6}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700)='/dev/sequencer2\x00', 0x10080, 0x0) ioctl$SIOCAX25GETINFOOLD(r3, 0x89e9, &(0x7f0000000080)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) dup2(r2, r0) [ 1730.035520][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000004440)='/proc/capi/capi20ncci\x00', 0x143880, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r3, 0x10f, 0x86) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2c00000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1730.170036][T18805] binder_transaction: 3 callbacks suppressed [ 1730.170050][T18805] binder: 18801:18805 transaction failed 29201/-22, size 0-4 line 3201 [ 1730.209331][T18806] serio: Serial port pts3 [ 1730.223547][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1730.264363][T18814] serio: Serial port pts8 [ 1730.404281][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1730.410242][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1730.416204][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1730.421971][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1730.724259][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1730.730036][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1730.735980][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1730.741774][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:03:55 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:55 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xb000000) 02:03:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x300, &(0x7f0000000300)}) 02:03:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x2f00000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0xfffffbffffffffff, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r1) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000000)=""/142) 02:03:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = getpgid(0x0) perf_event_open(&(0x7f00000000c0)={0x3, 0x70, 0x4, 0x2, 0x4, 0x2b, 0x0, 0x2, 0x40, 0x4, 0x1, 0x5, 0x10001, 0x98, 0x6, 0x6, 0x1, 0x3, 0x4, 0x9, 0x8, 0x503, 0xfba0, 0x9, 0x1ff, 0x101, 0x7, 0x9, 0x2f, 0x6, 0x9, 0xa0, 0x2, 0x9, 0x8, 0x1, 0x80000001, 0x3f3c, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000000), 0xf}, 0x800, 0xfffffffffffffff9, 0x3ff, 0x3, 0x9, 0x5, 0x3f}, r3, 0xa, 0xffffffffffffff9c, 0x2) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="7700000000de98000401ff00000000006601225f33fb2775b59e2e853897fa"], 0x10) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup2(r0, r0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000001c0)) connect$ax25(r1, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@null, @bcast, @null, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) ioctl$TCFLSH(r0, 0x540b, 0x0) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0xa) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) 02:03:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3578200000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1730.876884][T18822] binder: 18818:18822 transaction failed 29201/-22, size 0-4 line 3201 02:03:55 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xc000000) 02:03:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x500, &(0x7f0000000300)}) 02:03:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x3c00000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1731.078958][T18846] binder: 18845:18846 transaction failed 29201/-22, size 0-4 line 3201 02:03:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) modify_ldt$read(0x0, &(0x7f0000000000)=""/2, 0x2) close(r0) [ 1731.133156][T18850] binder: 18845:18850 transaction failed 29201/-22, size 0-4 line 3201 02:03:56 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe000000) 02:03:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0xaba5a1733109329c, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x8000, 0x0) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000040)={0xfffffffffffffffa, 0x7ff}) readv(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) ioctl$SIOCX25GSUBSCRIP(r2, 0x89e0, &(0x7f0000000180)={'bridge0\x00', 0xffff, 0x1}) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x6500, 0x1) 02:03:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4000000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x600, &(0x7f0000000300)}) 02:03:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0xfffffffffffffffd, @remote}, 0x1c) r1 = syz_open_dev$media(&(0x7f0000000400)='/dev/media#\x00', 0x9, 0x10082) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000440)={0x0, 0x9, 0x9, 0x0, 0x5, 0x0, 0x2, 0x1, {0x0, @in6={{0xa, 0x4e22, 0x5, @local, 0x1}}, 0x0, 0x8001, 0x4, 0xee28, 0x6}}, &(0x7f0000000500)=0xb0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000540)={r2, 0x6}, &(0x7f0000000580)=0x8) listen(r0, 0xff) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x6, 0x2, 0x5, 0x9, 0x5}, &(0x7f0000000080)=0x14) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300)='/dev/zero\x00', 0x501000, 0x0) ioctl$TUNGETFEATURES(r4, 0x800454cf, &(0x7f0000000340)) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000000c0)={r3, 0x4}, 0x8) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) chdir(&(0x7f0000000100)='./file0\x00') r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000600)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r4, &(0x7f00000007c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000640)={0x114, r7, 0x800, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x28, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}]}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x48f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x800}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xec}]}, @TIPC_NLA_BEARER={0xa8, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x86}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @local}}, {0x20, 0x2, @in6={0xa, 0x3ff, 0x4, @local, 0x10001}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK={0x4}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x48000) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendto(r1, &(0x7f0000000240)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r8 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x7fff, 0x20000) getsockopt$inet_mreq(r4, 0x0, 0x24, &(0x7f0000000380)={@loopback, @loopback}, &(0x7f00000003c0)=0x8) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="018f25bd7000fc273b02f10000007fe400e2ffffff00d1ebb3c543029df01a6c4a4559c618eb63c7288ae7dc45342fafb35b32fa749045c860"], 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x20000000) close(r0) 02:03:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf000000) [ 1731.823923][T18867] binder_transaction: 4 callbacks suppressed [ 1731.823938][T18867] binder: 18861:18867 got transaction with invalid offsets size, 4 [ 1731.838082][T18867] binder: 18861:18867 transaction failed 29201/-22, size 0-4 line 3201 02:03:56 executing program 2: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000040)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r1) 02:03:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x4305000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1731.907143][T18867] binder: 18861:18867 got transaction with invalid offsets size, 4 [ 1731.953875][T18867] binder: 18861:18867 transaction failed 29201/-22, size 0-4 line 3201 02:03:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xe6, 0x40000) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r2, 0xc0905664, &(0x7f0000000080)={0x0, 0x0, [], @bt={0xb5, 0x8b, 0x7, 0x100000001, 0x80, 0x8000, 0x1, 0xc}}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f00000001c0)={0x9, 0x1000}) close(r0) 02:03:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x700, &(0x7f0000000300)}) [ 1732.017430][T18880] serio: Serial port pts3 02:03:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x10000000) [ 1732.155355][T18889] binder: 18888:18889 got transaction with invalid offsets size, 4 [ 1732.188222][T18889] binder: 18888:18889 transaction failed 29201/-22, size 0-4 line 3201 [ 1732.215484][T18892] binder: 18888:18892 got transaction with invalid offsets size, 4 [ 1732.217080][T30760] binder_release_work: 5 callbacks suppressed [ 1732.217086][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1732.244293][T18892] binder: 18888:18892 transaction failed 29201/-22, size 0-4 line 3201 [ 1732.265454][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:57 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x6000000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/21, 0xffffff98}], 0x100000000000023b) dup2(r1, r0) syncfs(r1) 02:03:57 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x11000000) 02:03:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) io_setup(0x3ff, &(0x7f0000000000)=0x0) io_destroy(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:03:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xa00, &(0x7f0000000300)}) [ 1732.746757][T18901] binder: 18895:18901 got transaction with invalid offsets size, 4 [ 1732.776750][T18901] binder: 18895:18901 transaction failed 29201/-22, size 0-4 line 3201 02:03:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8000000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:57 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x14000000) [ 1732.812294][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x1200, &(0x7f0000000300)}) 02:03:57 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f000088f000)='\x00\x00\x00', 0x4) r3 = syz_open_dev$dmmidi(&(0x7f0000000240)='/dev/dmmidi#\x00', 0x2, 0x8000) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000280)={0xfffffffffffffffd, 0x9, 0x400, 0x2, 0x17, 0x1, 0x2, 0xfffffffffffffa6e, 0xfffffffffffffff8, 0x4, 0x0, 0x6}) fallocate(r2, 0x0, 0x0, 0x3) dup3(r0, r2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f00003b9fdc)) r5 = syz_open_pts(r4, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r5, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r6 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x40}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f00000001c0)={r7, 0x100}, 0x8) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000000)={0x2, 0x1f, 0x5, 0x9, 0x9, 0x7, 0x0, 0x6, 0xff, 0xf0f, 0x370d, 0x3f}) dup2(r5, r4) 02:03:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x800e000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:57 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x18000000) [ 1733.001941][T18920] binder: 18917:18920 got transaction with invalid offsets size, 4 [ 1733.045734][T18920] binder: 18917:18920 transaction failed 29201/-22, size 0-4 line 3201 [ 1733.103536][T18925] binder: 18917:18925 got transaction with invalid offsets size, 4 [ 1733.104919][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1733.183228][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:58 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = dup(r0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x4, 0x51, [], 0x6, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000100)=""/81}, &(0x7f0000000000)=0x78) listen(r0, 0xff) rt_sigpending(&(0x7f0000000280), 0x8) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) rt_sigpending(&(0x7f0000000240), 0x8) close(r0) 02:03:58 executing program 2: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r0, 0xffffffffffffffff) 02:03:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8035000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:58 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1c010000) 02:03:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x2000, &(0x7f0000000300)}) [ 1733.637874][T18935] binder: 18933:18935 got transaction with invalid offsets size, 4 02:03:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8100000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:58 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x20000000) [ 1733.680369][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10000, 0x0) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000080)=0x3) dup2(r1, r0) 02:03:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4800, &(0x7f0000000300)}) 02:03:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x86ddffff00000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000000c0), 0x2dc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r2) [ 1733.857344][T18959] binder: 18954:18959 got transaction with invalid offsets size, 4 [ 1733.907281][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:59 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x24000000) 02:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000080)={0x0, 0x35, 0x40, &(0x7f0000000040)=0x8}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4c00, &(0x7f0000000300)}) 02:03:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8847000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:59 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x88200) write$FUSE_WRITE(r0, &(0x7f0000000080)={0x18, 0x0, 0x4, {0xb3d}}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0xff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4001fc) sendto(r2, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r1) 02:03:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x24010000) [ 1734.394670][T18971] binder: 18970:18971 got transaction with invalid offsets size, 4 02:03:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8848000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1734.442013][T18975] serio: Serial port pts3 [ 1734.464678][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6000, &(0x7f0000000300)}) 02:03:59 executing program 2: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x404000, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="ec1b8e63f07752c7f289f71f2062d727c3108787cbd13ddc2cc2f895f7af848f8cba9f4b65db8ff7b6f078265361755e7a8c806b056cd37bd39f26098212dccc7e3fb132ab1f7ea3f8c780c2539ebb7fa21886ad3cc52636caa22e34a96d3a4e7ae44dee6231dbc409544cfb3944adbcfd087c688ace83e24e1c84d5da9b3ff5ee8ba33e25dfe9ff0bddcaa42f24189e6ef64c71e73c4204ee7792690a9dcdd9141de584d3c372a550c59313ba093af138dc06a3c1290d1510346858918c7f26d120cec3657a98db6ae53d4bde65eea6417350985bcebe07a55261ff6e0661a88678934aa76e44cc31a779c7e56a143fe911e173724fb7", 0xf7}], 0x1, 0x8) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000080), 0x0) dup2(r2, r1) [ 1734.564256][ C0] net_ratelimit: 16 callbacks suppressed [ 1734.564264][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1734.575810][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1734.581617][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1734.587418][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:03:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2c010000) 02:03:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r0, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0xfffffffffffffdd0) close(r0) [ 1734.633110][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1734.646708][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:03:59 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:03:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8864000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6800, &(0x7f0000000300)}) 02:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x0, 0x68000) ioctl$RTC_UIE_ON(r2, 0x7003) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x48200) ioctl$VIDIOC_SUBDEV_S_EDID(r3, 0xc0285629, &(0x7f0000000080)={0x0, 0x8, 0xbba, [], &(0x7f0000000040)=0xffffffffffffffb8}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:03:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x30000000) 02:03:59 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0xfffffffffffffe43) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) [ 1734.884239][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1734.890060][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1734.895922][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1734.901675][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1735.000329][T19012] serio: Serial port pts3 02:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6c00, &(0x7f0000000300)}) 02:03:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88a8ffff00000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x40000000) 02:03:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x200, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) fcntl$getown(0xffffffffffffffff, 0x9) dup2(0xffffffffffffffff, r0) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x80000000) 02:03:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x88caffff00000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7400, &(0x7f0000000300)}) [ 1735.124351][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1735.130168][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1735.267012][T19040] binder_transaction: 9 callbacks suppressed [ 1735.267027][T19040] binder: 19037:19040 transaction failed 29201/-22, size 0-4 line 3201 [ 1735.342901][T19040] binder: 19037:19040 transaction failed 29201/-22, size 0-4 line 3201 02:04:00 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) 02:04:00 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x44000000) 02:04:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x8906000000000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x7fffffff, 0x8000) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7a00, &(0x7f0000000300)}) [ 1735.931962][T19051] binder: 19046:19051 transaction failed 29201/-22, size 0-4 line 3201 [ 1735.945297][T19053] serio: Serial port pts3 02:04:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x89ffffff00000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:00 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xa0010000) 02:04:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000ff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)=0x80080) close(r0) [ 1735.974219][T19058] binder: 19046:19058 transaction failed 29201/-22, size 0-4 line 3201 [ 1736.000519][T19059] serio: Serial port pts8 02:04:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x9}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xffffffff00000000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x1000000, &(0x7f0000000300)}) [ 1736.209500][T19073] binder: 19072:19073 transaction failed 29201/-22, size 0-4 line 3201 [ 1736.267467][T19078] binder: 19072:19078 transaction failed 29201/-22, size 0-4 line 3201 02:04:01 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:01 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe4ffffff) 02:04:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0xfffffffffffff000, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x80082) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x0, 0x2) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f0000000080)) dup2(r1, r0) 02:04:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) close(r0) getresgid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) 02:04:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x2000000, &(0x7f0000000300)}) [ 1736.848973][T19090] binder_transaction: 11 callbacks suppressed [ 1736.848984][T19090] binder: 19089:19090 got transaction with invalid offsets size, 4 [ 1736.876968][T19091] serio: Serial port pts3 02:04:01 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe7000000) 02:04:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1736.897044][T19090] binder: 19089:19090 transaction failed 29201/-22, size 0-4 line 3201 02:04:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = semget$private(0x0, 0x7, 0x18) semctl$IPC_RMID(r2, 0x0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1736.960716][T19090] binder: 19089:19090 got transaction with invalid offsets size, 4 [ 1737.000477][T19090] binder: 19089:19090 transaction failed 29201/-22, size 0-4 line 3201 02:04:01 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe8030000) 02:04:01 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000100)={0x3, 0x2, 0x11, &(0x7f0000000080)="03f9ee05a2e49aa240ba056d3823744c7e"}) 02:04:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1737.089108][T19107] serio: Serial port pts3 [ 1737.168375][T19115] serio: Serial port pts8 02:04:02 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x3000000, &(0x7f0000000300)}) 02:04:02 executing program 3: clone(0x3102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, 0x0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="500055ef3600000000cb03f6ffffffffff000000f258ac0104307da6044bbe2a7398062257b1604a2e0048b9126cd08b4aacaeb90000a4aa29"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:04:02 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xec030000) 02:04:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x11}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:02 executing program 3: clone(0x3102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, 0x0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="500055ef3600000000cb03f6ffffffffff000000f258ac0104307da6044bbe2a7398062257b1604a2e0048b9126cd08b4aacaeb90000a4aa29"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:04:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x5, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:02 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf0000000) [ 1737.803245][T19131] binder: 19117:19131 got transaction with invalid offsets size, 4 [ 1737.822664][T19127] serio: Serial port pts3 [ 1737.832901][T19131] binder: 19117:19131 transaction failed 29201/-22, size 0-4 line 3201 [ 1737.874605][T30760] binder_release_work: 11 callbacks suppressed [ 1737.874613][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4000000, &(0x7f0000000300)}) 02:04:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x6, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20000000003ffffd, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0xc2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdc67, 0x0, 0x3}) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000040)={0x9, 0x2, 0x5, 0x2, 0x17, 0x1, 0x80, 0x7, 0x7, 0x2, 0x5, 0x4}) r2 = socket$nl_crypto(0x10, 0x3, 0x15) r3 = syz_open_pts(r0, 0x0) getsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r3, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r4 = dup2(r3, r0) ioctl$VIDIOC_S_AUDOUT(r4, 0x40345632, &(0x7f0000000000)={0x1, "ed52ec43162d8a6304abbd235dfb0d5da787a801cca4e68caac2441c00", 0x2, 0x1}) [ 1738.032941][T19147] binder: 19146:19147 got transaction with invalid offsets size, 4 [ 1738.050814][T19147] binder: 19146:19147 transaction failed 29201/-22, size 0-4 line 3201 [ 1738.063187][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:03 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:03 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf0030000) 02:04:03 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x5000000, &(0x7f0000000300)}) 02:04:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000}) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r1 = syz_open_pts(r0, 0x0) sendfile(r0, r0, &(0x7f0000000080)=0x101, 0xfffffffffffffff9) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) socketpair(0xd93d8bf75dd220be, 0x6, 0x8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r3, 0x110, 0x5, &(0x7f00000001c0)=[0x4, 0x3], 0x2) dup2(r1, r0) [ 1738.670438][T19160] binder: 19159:19160 got transaction with invalid offsets size, 4 [ 1738.685464][T19158] serio: Serial port pts3 02:04:03 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf1030000) [ 1738.712296][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1739.764267][ C0] net_ratelimit: 24 callbacks suppressed [ 1739.764275][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1739.775727][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1740.814240][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1740.820038][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1740.825875][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1740.831609][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:05 executing program 3: clone(0x3102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, 0x0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="500055ef3600000000cb03f6ffffffffff000000f258ac0104307da6044bbe2a7398062257b1604a2e0048b9126cd08b4aacaeb90000a4aa29"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:04:05 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xd, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6000000, &(0x7f0000000300)}) 02:04:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r1) 02:04:05 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf2030000) 02:04:05 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:05 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x28, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:05 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf3030000) [ 1740.932864][T19181] binder: 19174:19181 got transaction with invalid offsets size, 4 [ 1740.944931][T19182] serio: Serial port pts3 [ 1740.968067][T19181] binder_transaction: 1 callbacks suppressed [ 1740.968083][T19181] binder: 19174:19181 transaction failed 29201/-22, size 0-4 line 3201 [ 1741.004471][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1741.005636][T19191] binder: 19174:19191 got transaction with invalid offsets size, 4 [ 1741.024291][T19191] binder: 19174:19191 transaction failed 29201/-22, size 0-4 line 3201 02:04:05 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x29, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:05 executing program 3: clone(0x3102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, 0x0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="500055ef3600000000cb03f6ffffffffff000000f258ac0104307da6044bbe2a7398062257b1604a2e0048b9126cd08b4aacaeb90000a4aa29"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 1741.071003][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7000000, &(0x7f0000000300)}) 02:04:05 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf4010000) [ 1741.124326][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1741.130134][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1741.135978][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1741.141761][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1741.186155][T19201] binder: 19200:19201 got transaction with invalid offsets size, 4 02:04:05 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2b, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1741.231537][T19201] binder: 19200:19201 transaction failed 29201/-22, size 0-4 line 3201 02:04:06 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf4030000) 02:04:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x8000000, &(0x7f0000000300)}) [ 1741.273073][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1741.372826][T19212] binder: 19211:19212 got transaction with invalid offsets size, 4 [ 1741.402337][T19212] binder: 19211:19212 transaction failed 29201/-22, size 0-4 line 3201 [ 1741.432790][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:06 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2c, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:06 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:06 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf8000000) 02:04:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xa000000, &(0x7f0000000300)}) [ 1741.800211][T19222] serio: Serial port pts3 02:04:06 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2f, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1741.828978][T19226] binder: 19224:19226 got transaction with invalid offsets size, 4 [ 1741.850617][T19226] binder: 19224:19226 transaction failed 29201/-22, size 0-4 line 3201 [ 1741.883796][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)) 02:04:08 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf8030000) 02:04:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x50800, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x2, 0x6e, 0x5, 0x9, 0x44}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000080)={r3, 0x3}, &(0x7f0000000240)=0x8) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x12000000, &(0x7f0000000300)}) 02:04:08 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3c, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:08 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1744.234966][T19243] binder: 19242:19243 got transaction with invalid offsets size, 4 [ 1744.254396][T19243] binder: 19242:19243 transaction failed 29201/-22, size 0-4 line 3201 [ 1744.265223][T19248] serio: Serial port pts3 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf8ff0100) 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x60, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1744.290594][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1744.323273][T19255] serio: Serial port pts8 02:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x20000000, &(0x7f0000000300)}) 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf9030000) 02:04:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = dup2(r1, r0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f0000000000)) 02:04:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(0xffffffffffffffff, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto(r1, &(0x7f0000000180)="fa", 0x1, 0xfffffffffffffffc, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x400200007fe, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x0, 0x0, @mcast1}}}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = getpgrp(0xffffffffffffffff) setpriority(0x0, r3, 0x10000) r4 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f0000000280)) setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000500)=@v3, 0x18, 0x0) readlink(0x0, 0x0, 0x0) getrandom(0x0, 0x0, 0x1) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f0000000200)=@v2={0x2000000, [{0xe24}]}, 0x14, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) ioctl$KVM_ENABLE_CAP(r4, 0x4068aea3, &(0x7f0000000400)={0x74, 0x0, [0x4, 0x2, 0x100000001]}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000ac0)) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='illinois\x00', 0x37f) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x28b20}], 0x1, &(0x7f0000000200)=""/20, 0x8034, 0x9ac42000}, 0x100) close(r0) 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xf0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1744.465701][T19267] binder: 19266:19267 got transaction with invalid offsets size, 4 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfa030000) [ 1744.524335][T19267] binder: 19266:19267 transaction failed 29201/-22, size 0-4 line 3201 [ 1744.557157][T19275] serio: Serial port pts3 [ 1744.562551][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x300, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x48000000, &(0x7f0000000300)}) 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfcff0000) [ 1744.688670][T19288] binder: 19287:19288 got transaction with invalid offsets size, 4 [ 1744.754902][T19288] binder: 19287:19288 transaction failed 29201/-22, size 0-4 line 3201 02:04:09 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x9b06000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x500, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfeffffff) 02:04:09 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendto$unix(r1, &(0x7f0000000080)="106e7295ea60d9d160d72209ceca46f7869f4e7f687ebc6b", 0x18, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001900)=""/169, 0xa9}], 0x1}, 0x0) [ 1744.825512][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4c000000, &(0x7f0000000300)}) [ 1744.897772][T19302] serio: Serial port pts3 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x543, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1744.960092][T19314] serio: Serial port pts8 [ 1744.964571][ C0] net_ratelimit: 16 callbacks suppressed [ 1744.964579][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1744.964639][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1744.964725][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1744.964769][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1744.999124][T19315] binder: 19312:19315 got transaction with invalid offsets size, 4 02:04:09 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xff9f0100) 02:04:09 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000004780)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000001480), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) llistxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r2 = gettid() tkill(r2, 0x1000000000013) 02:04:09 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x600, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1745.015953][T19315] binder: 19312:19315 transaction failed 29201/-22, size 0-4 line 3201 [ 1745.033449][T19320] binder: 19312:19320 got transaction with invalid offsets size, 4 [ 1745.042962][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1745.049763][T19320] binder: 19312:19320 transaction failed 29201/-22, size 0-4 line 3201 [ 1745.058528][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) timer_create(0x7, &(0x7f0000000000)={0x0, 0x31, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) timer_delete(r1) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r0) 02:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x60000000, &(0x7f0000000300)}) [ 1745.182180][T19330] serio: Serial port pts3 [ 1745.209242][T19332] binder: 19331:19332 got transaction with invalid offsets size, 4 [ 1745.229013][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1745.284232][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1745.290174][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1745.296013][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1745.301776][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1745.524271][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1745.530077][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:10 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:10 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xffffff7f) 02:04:10 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x608, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x68000000, &(0x7f0000000300)}) 02:04:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x199041, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r2, 0xc058534b, &(0x7f0000000040)={0x6, 0xa60, 0x593b, 0x3, 0x7}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r1, r0) r4 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'ifb0\x00', 0x0}) getsockname$packet(r3, &(0x7f0000001600)={0x11, 0x0, 0x0}, &(0x7f0000001640)=0x14) accept4$packet(r2, &(0x7f0000001680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000016c0)=0x14, 0x800) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001700)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000001800)=0xe8) getsockname(r3, &(0x7f0000001840)=@can={0x1d, 0x0}, &(0x7f00000018c0)=0x80) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001940)={'veth0_to_team\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000001a40)={'vcan0\x00', 0x0}) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000001a80)={0x0, @rand_addr, @empty}, &(0x7f0000001ac0)=0xc) accept(r2, &(0x7f0000001b00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001b80)=0x80) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000001bc0)={0x0, @remote, @dev}, &(0x7f0000001c00)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000001c40)={'team0\x00', 0x0}) accept4$packet(r2, &(0x7f0000001d40)={0x11, 0x0, 0x0}, &(0x7f0000000240)=0x14, 0x807ff) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001dc0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000002000)={'vcan0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000002040)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000002140)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f00000026c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x41000000}, 0xc, &(0x7f0000002680)={&(0x7f0000002180)={0x4d4, r4, 0x108, 0x70bd2d, 0x25dfdbfb, {}, [{{0x8, 0x1, r5}, {0x7c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x278, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffb}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x8, 0x7, 0x6, 0x100000001}, {0x8, 0x5, 0x20000000000000, 0x13ee}, {0x5, 0x9, 0x7fffffff, 0x4}, {0x30, 0x3, 0x1ff, 0x69}, {0xff, 0x0, 0xfffffffffffffff8, 0x8}, {0x3, 0x0, 0xad, 0x9}]}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r15}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r17}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x8, 0x9, 0x4, 0x6}]}}}]}}]}, 0x4d4}, 0x1, 0x0, 0x0, 0x4000080}, 0x800) 02:04:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6c000000, &(0x7f0000000300)}) [ 1745.778065][T19340] binder: 19338:19340 got transaction with invalid offsets size, 4 [ 1745.801581][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1745.820224][T19342] serio: Serial port pts3 02:04:10 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xffffffe4) 02:04:10 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x689, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1745.875590][T19349] binder: 19348:19349 got transaction with invalid offsets size, 4 [ 1745.916439][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:12 executing program 3: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:12 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfffffffe) 02:04:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x74000000, &(0x7f0000000300)}) 02:04:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f0000000040)={0x7, 0x100000000, 0x1d4000, 0x8, 0x8000, 0xfffffffffffffffc}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x6, 0x400) 02:04:12 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x806, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:12 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:12 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x8000000000) [ 1748.147163][T19362] serio: Serial port pts3 [ 1748.162056][T19370] binder: 19369:19370 got transaction with invalid offsets size, 4 02:04:12 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xd00, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1748.198465][T19370] binder_transaction: 3 callbacks suppressed [ 1748.198481][T19370] binder: 19369:19370 transaction failed 29201/-22, size 0-4 line 3201 [ 1748.228616][T19374] serio: Serial port pts8 02:04:13 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1a0ffffffff) [ 1748.249409][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7a000000, &(0x7f0000000300)}) 02:04:13 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xe80, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1748.390468][T19388] binder: 19385:19388 got transaction with invalid offsets size, 4 [ 1748.447383][T19388] binder: 19385:19388 transaction failed 29201/-22, size 0-4 line 3201 [ 1748.478269][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1748.478716][T19391] serio: Serial port pts3 02:04:13 executing program 3: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x18000000) 02:04:13 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1000000000000) 02:04:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xa0010000, &(0x7f0000000300)}) 02:04:13 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2800, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x280000) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000000)=0x4000000000000002, 0x4) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1748.711333][T19403] binder: 19401:19403 transaction failed 29201/-22, size 0-4 line 3201 02:04:13 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:13 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2900, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:13 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x40030000000000) 02:04:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xfdfdffff, &(0x7f0000000300)}) 02:04:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:13 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x100000000000000) 02:04:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xfffffdfd, &(0x7f0000000300)}) [ 1749.066338][T19420] binder: 19416:19420 transaction failed 29201/-22, size 0-4 line 3201 [ 1749.086031][T19419] serio: Serial port pts3 02:04:13 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2b00, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:13 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) clock_adjtime(0x4, &(0x7f0000000180)={0x0, 0x2, 0x2, 0x59, 0x2, 0x4800, 0x7ff, 0x7b, 0x2, 0x7fffffff, 0x4, 0x0, 0x5, 0x40bc, 0x101, 0x80, 0x4, 0x0, 0x2, 0x3, 0x8001, 0x10000, 0x3, 0x0, 0x0, 0x100000001}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f00000003c0)=0x7, &(0x7f0000000400)=0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x1, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000380)={&(0x7f0000000280), 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x800, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x10) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000, 0x4}) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) r3 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000fd0ffc)=0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000080)) readv(r3, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r3, r1) 02:04:13 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x200000000000000) [ 1749.199380][T19436] binder: 19432:19436 transaction failed 29201/-22, size 0-4 line 3201 02:04:14 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:14 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2c00, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x1a0ffffffff, &(0x7f0000000300)}) 02:04:14 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x300000000000000) 02:04:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socket(0xb, 0x800, 0xe6) r1 = syz_open_pts(r0, 0x0) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0xc00) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000040)={{0x2, 0xffffffffffffff00}, {0x4, 0xff}, 0x0, 0x2, 0x3}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1750.009183][T19454] binder_transaction: 3 callbacks suppressed [ 1750.009194][T19454] binder: 19451:19454 got transaction with invalid offsets size, 4 02:04:14 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x400000000000000) 02:04:14 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2f00, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1750.056835][T19457] serio: Serial port pts3 [ 1750.070319][T19454] binder: 19451:19454 transaction failed 29201/-22, size 0-4 line 3201 [ 1750.102159][T19457] serio: Serial port pts9 [ 1750.102485][ T5] binder_release_work: 3 callbacks suppressed [ 1750.102491][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) 02:04:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000900), &(0x7f0000000940)=0x30) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r3 = dup2(r2, r1) recvmsg$kcm(r3, &(0x7f00000008c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000180)=""/242, 0xf2}, {&(0x7f0000000080)=""/44, 0x2c}, {&(0x7f0000000280)=""/212, 0xd4}, {&(0x7f0000000380)=""/139, 0x8b}, {&(0x7f0000000440)=""/129, 0x81}, {&(0x7f0000000500)=""/58, 0x3a}, {&(0x7f0000000540)=""/220, 0xdc}, {&(0x7f0000000640)=""/11, 0xb}, {&(0x7f0000000680)=""/97, 0x61}, {&(0x7f0000000700)=""/231, 0xe7}], 0xa}, 0x2000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000980)={0x0, 0xffffffffffffffd9}, &(0x7f00000009c0)=0xc) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000a80)="c76e3e8a10ff6d0c1c7709bd9f6ac88eaab105176cb764bb92755d697671ef7903e5e290cbbe20e9364176eb35e5750c634f7f871dd7e20c") getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000a00)=@sack_info={r4, 0x9, 0x1}, &(0x7f0000000a40)=0xc) [ 1750.164363][ C0] net_ratelimit: 24 callbacks suppressed [ 1750.164371][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1750.175805][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x100000000000000, &(0x7f0000000300)}) 02:04:15 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x500000000000000) [ 1750.271374][T19473] serio: Serial port pts3 [ 1750.316466][T19478] binder: 19476:19478 got transaction with invalid offsets size, 4 [ 1750.329453][T19480] serio: Serial port pts9 [ 1750.341568][T19478] binder: 19476:19478 transaction failed 29201/-22, size 0-4 line 3201 [ 1750.361210][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:15 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:15 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3580, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:15 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x600000000000000) 02:04:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) epoll_create1(0x80000) 02:04:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x200000000000000, &(0x7f0000000300)}) 02:04:15 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x700000000000000) [ 1750.947714][T19492] binder: 19489:19492 got transaction with invalid offsets size, 4 [ 1750.984299][T19492] binder: 19489:19492 transaction failed 29201/-22, size 0-4 line 3201 [ 1750.984330][T19491] serio: Serial port pts3 02:04:15 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3c00, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x300000000000000, &(0x7f0000000300)}) [ 1751.005701][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) 02:04:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0xfffffffffffffffd, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:15 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x800000000000000) 02:04:15 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1751.148359][T19506] binder: 19504:19506 got transaction with invalid offsets size, 4 [ 1751.188720][T19506] binder: 19504:19506 transaction failed 29201/-22, size 0-4 line 3201 [ 1751.204350][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1751.210261][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1751.216110][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1751.220807][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1751.221954][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1751.524233][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1751.530032][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1751.535854][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1751.541590][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:16 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:16 executing program 2: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000fd0ffc)=0x4) r1 = add_key(&(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)="b983f07a74a79a47e640ad69cedfdababfd07b155fe11ceedada02cad5c409680c368e1a5750772ede6c5451e181f1a07927d45432a0cee6db4cf94ef80b4565258e2df85a665d6c7a54ea448261141a4bee79aa033677830bf2ab765ee6254cfad77b329a3c6db027d3a3892ba8d40e0e5d055b51151ec235a9cab587922292829b6922b6e4706aabfd01fc42a917a18d8a394c55a3fbc002f5a0dc81cea6c15fc4b251e701e7f695d03ad4d1496dd3d2bf3d4de5dd0bf20ac03996cc43b82c69fe3f3026f96b92b6b6dc36b79f008a68feee57ec754d2ad1a446efa4e976725056079a", 0xe4, 0xfffffffffffffff8) keyctl$get_keyring_id(0x0, r1, 0x7) readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) r2 = syz_open_dev$dspn(&(0x7f00000002c0)='/dev/dsp#\x00', 0x0, 0x42002) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r2, 0xc0905664, &(0x7f0000000300)={0x0, 0x0, [], @raw_data=[0x5, 0xf5, 0x4, 0x2, 0x6, 0x3, 0x10001, 0x1000, 0xa8, 0x81, 0x1f, 0x5, 0x9, 0x0, 0x0, 0x100000001, 0x1, 0xfffffffffffffff7, 0x800, 0x100000000, 0xf07, 0x100000001, 0x1, 0x6, 0xffff, 0x20, 0x4, 0x92, 0x1, 0x9, 0x44, 0xfff]}) r3 = dup2(r0, 0xffffffffffffffff) setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x4e22, 0x8, @rand_addr="663c1491416873344917263d89cee4bc", 0x2}, {0xa, 0x4e22, 0x7, @ipv4={[], [], @multicast1}, 0x4}, 0x70544e48, [0x0, 0xc5, 0x1f, 0x3, 0x0, 0x1, 0x8, 0x7fff]}, 0x5c) write$P9_RLOCK(r3, &(0x7f0000000080)={0x8, 0x35, 0x2}, 0x8) 02:04:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x400000000000000, &(0x7f0000000300)}) 02:04:16 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x900000000000000) 02:04:16 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4305, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:16 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xa00000000000000) [ 1751.914011][T19524] binder: 19522:19524 got transaction with invalid offsets size, 4 [ 1751.947050][T19524] binder: 19522:19524 transaction failed 29201/-22, size 0-4 line 3201 02:04:16 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4788, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) 02:04:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x20000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1751.979935][T19533] binder: 19522:19533 got transaction with invalid offsets size, 4 [ 1751.979978][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:16 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xb00000000000000) 02:04:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x500000000000000, &(0x7f0000000300)}) [ 1752.042036][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:16 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xc00000000000000) [ 1752.150905][T19546] binder: 19544:19546 got transaction with invalid offsets size, 4 [ 1752.175857][T19547] serio: Serial port pts8 [ 1752.184343][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:17 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:17 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4888, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x600000000000000, &(0x7f0000000300)}) 02:04:17 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe00000000000000) 02:04:17 executing program 2: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x400, 0x0) connect$vsock_dgram(r0, &(0x7f0000000280)={0x28, 0x0, 0x0, @reserved}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0x2) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt(r3, 0x100, 0x3, &(0x7f0000000000)=""/21, &(0x7f0000000040)=0x15) ioctl$sock_proto_private(r1, 0x89e1, &(0x7f0000000180)="35d338d3a2e91f3e59cc16e7404b350ee8cae7db5694588f483a3054435808ad694c12d5de43c67c14e17224bc7243ba8a81e5385d4347711c051774888e3cd1d3783daf08407bc0a70d65dd5fabc31ecc60d5474ad22ec43cf744e07b212b4152a4d204e83d29fa37fd4188788172668df752a7df01684e920b6ddc8cb7a889e1590ba896e290332ec13b615100758530d0c663841be9385cc831e4026d6ad2d0b0b0bc4e64732185de60133fcfc1410832924bf4f3b9095d5cecba044cc6e6a1232650309004257b74d587a287606bf8b4d2e195681c88eab736dfd06de7769b70e4ad16d7b2942ce962ec") readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r2, r1) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setfsgid(r4) [ 1752.887922][T19558] serio: Serial port pts8 02:04:17 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x6000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1752.908213][T19559] binder: 19555:19559 got transaction with invalid offsets size, 4 [ 1752.946150][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:17 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf00000000000000) 02:04:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x700000000000000, &(0x7f0000000300)}) 02:04:17 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x6488, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:17 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1753.123139][T19583] binder: 19576:19583 got transaction with invalid offsets size, 4 [ 1753.153819][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:18 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x800e, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1000000000000000) 02:04:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x800000000000000, &(0x7f0000000300)}) 02:04:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1100000000000000) [ 1753.864704][T19595] binder: 19593:19595 got transaction with invalid offsets size, 4 [ 1753.872668][T19595] binder_transaction: 4 callbacks suppressed [ 1753.872685][T19595] binder: 19593:19595 transaction failed 29201/-22, size 0-4 line 3201 02:04:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8035, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xa00000000000000, &(0x7f0000000300)}) 02:04:18 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1753.942270][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) 02:04:18 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8100, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:18 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1400000000000000) [ 1754.057729][T19615] binder: 19613:19615 transaction failed 29201/-22, size 0-4 line 3201 02:04:19 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x1200000000000000, &(0x7f0000000300)}) 02:04:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) 02:04:19 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1800000000000000) 02:04:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8847, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1754.852298][T19629] binder: 19628:19629 transaction failed 29201/-22, size 0-4 line 3201 02:04:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) 02:04:19 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x1c01000000000000) 02:04:19 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8848, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x2000000000000000, &(0x7f0000000300)}) 02:04:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:19 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8864, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1755.058284][T19652] binder_transaction: 2 callbacks suppressed [ 1755.058295][T19652] binder: 19647:19652 got transaction with invalid offsets size, 4 [ 1755.087374][T19652] binder: 19647:19652 transaction failed 29201/-22, size 0-4 line 3201 [ 1755.140245][T19652] binder: 19647:19652 got transaction with invalid offsets size, 4 [ 1755.140632][ T5] binder_release_work: 2 callbacks suppressed [ 1755.140639][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1755.176552][T19652] binder: 19647:19652 transaction failed 29201/-22, size 0-4 line 3201 [ 1755.224305][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1755.375185][ C0] net_ratelimit: 16 callbacks suppressed [ 1755.375269][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1755.387319][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1755.393838][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1755.400208][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1755.684249][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1755.690025][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1755.695855][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1755.701631][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2000000000000000) 02:04:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8906, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:20 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4800000000000000, &(0x7f0000000300)}) 02:04:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2400000000000000) 02:04:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1755.860435][T19667] binder: 19666:19667 got transaction with invalid offsets size, 4 [ 1755.888975][T19667] binder: 19666:19667 transaction failed 29201/-22, size 0-4 line 3201 [ 1755.924300][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1755.930086][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1755.955014][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:20 executing program 2: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4400) 02:04:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xf000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x4c00000000000000, &(0x7f0000000300)}) 02:04:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2401000000000000) 02:04:20 executing program 3: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r0, 0xffffffffffffffff) 02:04:20 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x207805, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1756.068124][T19683] binder: 19682:19683 got transaction with invalid offsets size, 4 [ 1756.123122][T19683] binder: 19682:19683 transaction failed 29201/-22, size 0-4 line 3201 02:04:20 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x2c01000000000000) 02:04:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) dup2(r1, r0) [ 1756.170190][T19692] binder: 19682:19692 got transaction with invalid offsets size, 4 [ 1756.171336][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1756.214508][T19692] binder: 19682:19692 transaction failed 29201/-22, size 0-4 line 3201 [ 1756.229057][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1756.323530][T19698] serio: Serial port pts3 02:04:21 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:21 executing program 3: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r0, 0xffffffffffffffff) 02:04:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x207835, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6000000000000000, &(0x7f0000000300)}) 02:04:21 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3000000000000000) 02:04:21 executing program 2: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x3fa) [ 1756.834648][T19702] binder: 19701:19702 got transaction with invalid offsets size, 4 [ 1756.842624][T19702] binder: 19701:19702 transaction failed 29201/-22, size 0-4 line 3201 02:04:21 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4000000000000000) 02:04:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xf0ffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:21 executing program 3: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r0, 0xffffffffffffffff) 02:04:21 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6800000000000000, &(0x7f0000000300)}) [ 1756.927350][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:21 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x1000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1757.085240][T19726] binder: 19724:19726 got transaction with invalid offsets size, 4 [ 1757.119492][T19726] binder: 19724:19726 transaction failed 29201/-22, size 0-4 line 3201 [ 1757.153834][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:22 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x4400000000000000) 02:04:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x6c00000000000000, &(0x7f0000000300)}) [ 1757.829127][T19738] binder: 19737:19738 got transaction with invalid offsets size, 4 02:04:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:22 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe4ffffff00000000) 02:04:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x400, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x280, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1757.916271][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7400000000000000, &(0x7f0000000300)}) 02:04:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:22 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1758.038719][T19752] serio: Serial port pts3 [ 1758.065878][T19757] binder: 19755:19757 got transaction with invalid offsets size, 4 [ 1758.106022][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:23 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe700000000000000) 02:04:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000080)=""/21, 0xf}], 0xea) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x400) dup2(r1, r0) 02:04:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x7a00000000000000, &(0x7f0000000300)}) 02:04:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x5000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xe803000000000000) 02:04:23 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x5782000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1758.867859][T19776] binder: 19768:19776 got transaction with invalid offsets size, 4 [ 1758.884018][T19777] serio: Serial port pts8 [ 1758.894068][T19776] binder_transaction: 2 callbacks suppressed [ 1758.894086][T19776] binder: 19768:19776 transaction failed 29201/-22, size 0-4 line 3201 [ 1758.950839][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000000000)) 02:04:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xfdfdffff00000000, &(0x7f0000000300)}) 02:04:23 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xec03000000000000) [ 1759.096950][T19793] binder: 19792:19793 transaction failed 29201/-22, size 0-4 line 3201 [ 1759.126896][T19794] serio: Serial port pts3 [ 1759.160658][T19793] binder: 19792:19793 transaction failed 29201/-22, size 0-4 line 3201 02:04:24 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x6000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf000000000000000) 02:04:24 executing program 2 (fault-call:6 fault-nth:0): syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0xffffffffa0010000, &(0x7f0000000300)}) 02:04:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1759.804014][T19806] binder: 19802:19806 transaction failed 29201/-22, size 0-4 line 3201 02:04:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf003000000000000) 02:04:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x100, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000100)) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x40000, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @rand_addr, @empty}, &(0x7f0000000240)=0xc) r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:24 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf103000000000000) [ 1759.971290][T19825] binder: 19820:19825 transaction failed 29201/-22, size 0-4 line 3201 02:04:24 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8060000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1760.564308][ C0] net_ratelimit: 24 callbacks suppressed [ 1760.564316][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1760.575805][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:25 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x410000, 0x0) connect$pppoe(r1, &(0x7f0000000100)={0x18, 0x0, {0x3, @random="1583edeba2e3", 'ifb0\x00'}}, 0x1e) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf203000000000000) 02:04:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xd000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:25 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1760.714726][T19841] binder_transaction: 4 callbacks suppressed [ 1760.714738][T19841] binder: 19836:19841 got transaction with invalid offsets size, 4 [ 1760.744527][T19841] binder: 19836:19841 transaction failed 29201/-22, size 0-4 line 3201 02:04:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x28000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:25 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf303000000000000) [ 1760.763821][ T5] binder_release_work: 4 callbacks suppressed [ 1760.763828][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xc3, &(0x7f0000000100)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000089dbb5dd0e8d4e35"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:25 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x29000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1760.972931][T19860] binder: 19858:19860 got transaction with invalid offsets size, 4 [ 1761.047718][T19860] binder: 19858:19860 transaction failed 29201/-22, size 0-4 line 3201 [ 1761.090352][T19860] binder: 19858:19860 got transaction with invalid offsets size, 4 [ 1761.106891][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1761.113650][T19860] binder: 19858:19860 transaction failed 29201/-22, size 0-4 line 3201 [ 1761.126870][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:26 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf401000000000000) 02:04:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2b000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f00000003c0)={0x200}, 0x1) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000080)=""/81, &(0x7f0000000180)=0x51) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x100, 0x200000) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/attr/exec\x00', 0x2, 0x0) setsockopt$netrom_NETROM_T4(r3, 0x103, 0x6, &(0x7f0000000100)=0x8, 0x4) mq_open(&(0x7f00000002c0)='/proc/self/attr/exec\x00', 0x41, 0xbf, &(0x7f0000000300)={0xffffffffffffff3e, 0x6, 0x3f, 0x401, 0x9, 0x5, 0x1000, 0x20972f55}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000800000000000000000d0f7e261", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f0000000340)) 02:04:26 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2c000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1761.553895][T19874] binder_alloc: 13398: binder_alloc_buf size -9223372036854775800 failed, no address space 02:04:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf403000000000000) [ 1761.601891][T19874] binder_alloc: allocated: 224 (num: 16 largest: 32), free: 12064 (num: 1 largest: 12064) [ 1761.614225][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1761.620019][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1761.625870][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1761.630053][T19874] binder: 19871:19874 transaction failed 29201/-28, size 0--9223372036854775804 line 3147 [ 1761.631619][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2f000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1761.712260][T19880] binder_alloc: 13398: binder_alloc_buf size -9223372036854775800 failed, no address space 02:04:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf800000000000000) [ 1761.764318][T19880] binder_alloc: allocated: 224 (num: 16 largest: 32), free: 12064 (num: 1 largest: 12064) [ 1761.777702][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1761.790919][T19880] binder: 19871:19880 transaction failed 29201/-28, size 0--9223372036854775804 line 3147 [ 1761.839899][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1761.924241][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1761.930095][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1761.935963][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1761.941725][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:26 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:26 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x35782000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x20000, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000180)=0x7fff, 0x4) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000040)='syz0\x00') ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r1) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x5, 0x4) r2 = openat$md(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0\x00', 0x2, 0x0) ioctl$NBD_CLEAR_SOCK(r2, 0xab04) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0xdd, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400080000069143fdc513ac3b838d0000000000000000000001000000000000000000200000000000000000000000000000000080000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="e4028e45bbfd79ef"]], 0xfffffffffffffffe, 0x0, &(0x7f0000000280)="7caf4197b52cc1e22f8c3a3bc616cef50462b4936a5ecb7299cd146aac2bb8c083b113c8da6daca251a229ad63a302c3aef790765bce9fca3326d405326dfdd004c47ee18ba4577345844ea5299eaaf55941c808741685e1a1390a46fcd619cbac8a77dd738b1ef6a42be819b6e8137353c846bfcedc1f11cdb48e4b7f0000000000000000000000000000000000"}) 02:04:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:26 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf803000000000000) 02:04:26 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf8ff010000000000) 02:04:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3c000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1762.293035][T19910] binder: 19908:19910 got transaction to invalid handle 02:04:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1762.338166][T19916] binder: 19908:19916 got transaction to invalid handle 02:04:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x40000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x80) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0xef) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0xffffffffffffffa8, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xb, 0x0, &(0x7f0000000300)="072a38ea1ece35dca6a2b6"}) 02:04:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xf903000000000000) 02:04:27 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x43050000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x20200, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000240)='tls\x00', 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x15, &(0x7f0000000280)=0x1, 0x4) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000030000929e9ac1007d5a8c3ab8e1a32300000000000000000000000000000000000000000000000700040000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000001900"]], 0x0, 0x0, &(0x7f0000000300)}) r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x100, 0x400) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f0000000180)=0x10) 02:04:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfa03000000000000) 02:04:27 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x64}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1762.849450][T30760] binder: undelivered TRANSACTION_COMPLETE [ 1762.856058][T30760] binder: undelivered TRANSACTION_COMPLETE 02:04:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x100, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000180)=0x5) r2 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x5) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xfffffffffffffe58, 0x0, &(0x7f0000000200)="e09bae6fcd51780cb336d923d71c81d967dc4849bd57ebb87bfa5c663096f13d7f748ff7f9c40c78970dd3edf47fc06bdb1cad5120d0cb8c4da65e80bbad89b6457d09a8e87b15e1b87960352e6a7cfcd89fe7721be24a86be69753ade245bcf20627b999e981b71424a688dea37a04935f6d3d602674e58adba1a2ed5e27c970321f5940cb567b33e57c67997757d7156d365973096ebc6b4af8043de6b0393790da5f204e9dde5dc91c27d9317c3503e"}) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000000)=0x3, 0x4) 02:04:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfcff000000000000) 02:04:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x60000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1763.020336][T19958] binder: 19956:19958 got transaction with invalid offset (0, min 0 max 0) or object. 02:04:27 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x800e0000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1763.064891][T19958] binder: 19956:19958 got transaction with invalid offset (0, min 0 max 0) or object. 02:04:27 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xfeffffff00000000) 02:04:28 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x80350000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x0, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000580)='/dev/vbi#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_MAP_BUFS(r2, 0xc0186419, &(0x7f0000000100)={0x3, &(0x7f0000000200)=""/69, &(0x7f0000000500)=[{0x80000001, 0x9d, 0x1, &(0x7f0000000280)=""/157}, {0x80000001, 0xcf, 0x7ff, &(0x7f0000000340)=""/207}, {0x5, 0x86, 0x0, &(0x7f0000000440)=""/134}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:28 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xff9f010000000000) 02:04:28 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6e1}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1763.814934][T19982] binder: 19974:19982 got transaction with invalid offsets size, 4 [ 1763.844570][T19985] binder: 19974:19985 got transaction with invalid offsets size, 4 02:04:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x81000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00*']], 0x0, 0x0, &(0x7f0000000300)}) [ 1763.869922][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1763.881851][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:28 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xffffff7f00000000) [ 1764.016242][T20000] binder: 19996:20000 got transaction with invalid offsets size, 4 02:04:28 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xffffffff00000000) 02:04:28 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x86ddffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1764.064502][T20000] binder_transaction: 6 callbacks suppressed [ 1764.064520][T20000] binder: 19996:20000 transaction failed 29201/-22, size 0-4 line 3201 [ 1764.155038][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:29 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b06000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:29 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f00}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x401, 0x11b440) ioctl$TCXONC(r2, 0x540a, 0x6) 02:04:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0xffffffffa0010000) 02:04:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88470000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1764.754655][T20012] binder: 20011:20012 got transaction with invalid offsets size, 4 [ 1764.788109][T20012] binder: 20011:20012 transaction failed 29201/-22, size 0-4 line 3201 02:04:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88480000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in6={{0xa, 0x4e23, 0x0, @mcast2, 0x10001}}, 0x7, 0xffff, 0x7, 0x5, 0x30}, &(0x7f0000000180)=0x98) 02:04:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1764.811698][T20012] binder: 20011:20012 got transaction with invalid offsets size, 4 [ 1764.821266][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1764.828361][T20012] binder: 20011:20012 transaction failed 29201/-22, size 0-4 line 3201 [ 1764.880147][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000140)={0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}) openat$cgroup_type(r1, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) ioctl(r0, 0x6, &(0x7f0000000080)="00000000000000000000007220aae09a64a279498e9bde1eba73d10a866076887d1e7d78c56fbf9d3435e408852b4886f9d385e00b6823704e0ded8271d4fbdb8a33") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sync() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000020b800000000040000000000000000000000000000004ce0258beef5d937cc6cbd9199a61a6d58836cc842efd7df77a057682494142aa4a9fd2ff8d7e0f4d295b9f2debf3855ee6d8784a8cfc1d006964d9203b9de8f20a6d82b9c6aa4de2fc96c3ab8c873e53323edf8f07f8cc5064094527508cb71f6556059e2dff475171e72855839c284d5024b5d1e403bc3f482442d9cd3b1b5378dcd19bc2100e152cb80f82a5644f4930a92d6b5c175804b", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000071db003b421234006a730085ed5fbca7676a024cb5c1b3d0afa4aba7ff6f779c2591e6d645d5e1bf56085034b899c3569581017bfe5cab7191504098417500d773c675898b3f460f6741196e67443d5721e7fa5245cfcf524056ef428193a19014d1ea740a499ac6cd193507edce392a383e36df9bced4552d267829ac972a3f26fc62835163185dceb95c8bd6b7af87eb75a0082dc44efe3f443e425d69b229334fc956d456586e7ad5a871a8d7122cbcb151cb0fb4af7583975015452c3e48d17698c883974b616a9681f05d03efa9c33097a17022ae075ca836b33a08a37ff13b77ea3f5c996e95233c3cdbad989be0a1"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:29 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88640000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:29 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) accept$netrom(r1, 0x0, &(0x7f0000000140)) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f00000000c0)='\x00', 0x1, 0x2) [ 1765.042737][T20042] binder_alloc: 13398: binder_alloc_buf size 3089104904 failed, no address space [ 1765.079728][T20042] binder_alloc: allocated: 240 (num: 18 largest: 32), free: 12048 (num: 1 largest: 12048) [ 1765.116560][T20042] binder: 20035:20042 transaction failed 29201/-28, size 3089104896-4 line 3147 [ 1765.181260][T20036] binder_alloc: 13398: binder_alloc_buf size 3089104904 failed, no address space [ 1765.207289][T20036] binder_alloc: allocated: 240 (num: 18 largest: 32), free: 12048 (num: 1 largest: 12048) [ 1765.223000][T20036] binder: 20035:20036 transaction failed 29201/-28, size 3089104896-4 line 3147 02:04:30 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88a8ffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:30 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6400}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:30 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e1d, @rand_addr=0xdb6a}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:30 executing program 0: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40000, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = inotify_init() dup3(r1, r2, 0x80000) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r4 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000100000000000"]], 0x0, 0x0, &(0x7f0000000300)}) userfaultfd(0x80000) [ 1765.592810][T20150] Unknown ioctl 19463 02:04:30 executing program 4: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x8000, 0x4) r1 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f00000002c0)="745cda3f7326c2876431b083d16c65f0bc768ed22a1d38f6e3d17b9ff7ad637c2cd7ebf624219a351bb1f2ca34408b7d67c6bf0f4526ea69b8aa7822240ec95c5ed2765d4fed396164d0b1fbca9d06270a0be16e246ef3fcae734e67088eaf11c304290747ec69c45b8fb43e07b2cd1e336e72e6c3166908769b9f9f113570dc323a873fbb3de8e682e7b9c2b73a214d7fe44693103c13f20141b1a342bf25c4cbb3f20e98984fac7a73558fe1b276b8da7ab4bab57501063eefc1d2852782564533b975a2093f1459cb89") r2 = getpgid(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, r2) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200)='nbd\x00') sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x90, r3, 0x0, 0x70bd28, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x44, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x90}, 0x1, 0x0, 0x0, 0x2004c800}, 0x44000) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f00000000c0)=""/185) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) 02:04:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88caffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1765.632179][T20150] binder: 20149:20150 got transaction with invalid offsets size, 4 [ 1765.656144][T20150] binder: 20149:20150 transaction failed 29201/-22, size 0-4 line 3201 [ 1765.742216][T20150] Unknown ioctl 19463 02:04:30 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x89060000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1765.764828][ C0] net_ratelimit: 16 callbacks suppressed [ 1765.764854][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1765.777154][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1765.783524][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1765.789944][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1765.811369][T20198] binder: 20149:20198 got transaction with invalid offsets size, 4 02:04:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, r0) [ 1765.849771][T20198] binder: 20149:20198 transaction failed 29201/-22, size 0-4 line 3201 02:04:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, 0x0, 0x0) dup2(r1, r0) [ 1765.928754][T30760] binder_release_work: 2 callbacks suppressed [ 1765.928760][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1765.944742][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1766.084272][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1766.090237][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1766.096119][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1766.101991][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:31 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x3, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000040)={0x2, [0x0, 0x0]}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={r1, 0x581a}, &(0x7f0000000140)=0x8) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x89ffffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:31 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0xe106}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f0000000180)=0x8) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, 0x0, 0x0) dup2(r1, r0) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xffffa888, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1766.324283][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1766.330145][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00\b\x00\x00'], &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={r2, 0x7fff}, &(0x7f0000000140)=0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, 0x0, 0x0) dup2(r1, r0) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xffffca88, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:31 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000040)={0x4, 0x2, 0x8000, 0x3, 0x0}, &(0x7f00000000c0)=0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={r1, 0x804}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1766.598993][T20408] binder: 20406:20408 got transaction with invalid offsets size, 4 [ 1766.644924][T20408] binder: 20406:20408 transaction failed 29201/-22, size 0-4 line 3201 [ 1766.682642][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:31 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xffffdd86, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100), 0x0) dup2(r1, r0) 02:04:31 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x1000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:31 executing program 4: r0 = socket$inet(0x2, 0xfffffffffffffffe, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) geteuid() write(r1, &(0x7f0000000200)="3a573bbf0fe673f80e83e6ab57469e85a2dc460f7548970e10361f4b5bbafa3df8e33b0632f53b3e384746c0e4ad9f46dec257fb28b5ecf1e871206d710ae19bda22c51575000bf2fea2ff7721b6a5e06291fbf616f3cc477c095ee65fadc63bb2ef76ee08f44369fcdc120367ae47c5469c169060c76ec69d0b7872b497a6f2162712677db88fe26864a9f67d0aa6a20c2d25c5c58cbb8897ed77cfbf7e6ca6dd105fdc9dea3fcf59d7ce2482", 0xad) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100), 0x0) dup2(r1, r0) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xfffff000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:31 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xffffff89, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1767.122076][T20423] binder: 20420:20423 got transaction with invalid offsets size, 4 02:04:31 executing program 4: r0 = socket$inet(0x2, 0x3, 0x1000) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r0, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/249, 0xf9}, {&(0x7f00000012c0)=""/157, 0x9d}], 0x3, &(0x7f0000001380)=""/151, 0x97}, 0x4}, {{&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f00000016c0)=[{&(0x7f0000001440)=""/226, 0xe2}, {&(0x7f0000001540)=""/121, 0x79}, {&(0x7f00000015c0)=""/237, 0xed}, {&(0x7f0000000040)}], 0x4, &(0x7f0000001700)=""/108, 0x6c}, 0xfff}], 0x2, 0x0, &(0x7f0000001800)={0x77359400}) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x20000000000000) 02:04:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100), 0x0) dup2(r1, r0) [ 1767.165591][T20423] binder: 20420:20423 transaction failed 29201/-22, size 0-4 line 3201 [ 1767.212160][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000700000002100000000000000000000000000000000000000000000000400066f0d36b4f73face5fbddba4123", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) [ 1767.339489][T20441] binder_alloc: 13398: binder_alloc_buf size -597793419208294392 failed, no address space [ 1767.360398][T20441] binder_alloc: allocated: 240 (num: 18 largest: 32), free: 12048 (num: 1 largest: 12048) [ 1767.381245][T20441] binder: 20440:20441 transaction failed 29201/-28, size 0--597793419208294396 line 3147 [ 1767.414223][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:32 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:32 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x9) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7, 0x50000) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000040)=0x3, &(0x7f00000000c0)=0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioperm(0x100000001, 0x800, 0x5) 02:04:32 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xf0ffffffffffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) dup2(r1, r0) 02:04:32 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000200)={r1, 0x4, 0x3ff, "e1a47a28152c04995bfff191ff0411a2fe57e8a5d4936c01c59e256ce6e595e6f159b7d0f23967c6f99e0e57b4c939ecea10819d56188c0aa5054672818349a4ab254de5925b91cb4e8b6e831424b160f394ba7fc4092860eea933c35ed2566ab5b328022c8551e4e03232a6461b12e73ce770e34853bd73edecda396c9d1924"}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100), 0xba, 0x0, &(0x7f00000002c0)="d7f3db4d5e84e59d02c1c50cb10280519808ed73b8d79b0abbea4cb68affe5b8c2aac3c075442a27799796a0b26490af396b889a55c06148d15290b96a21257bcf15354e72894e1d35cabb74266d7d77990161fdeff973752be7479816db7a41d0ca65e6f5806c6b8880e0a0bc80050f0fcdad7924976f8227a8a5c88b339ad2e74d908f763cca6e23d69b26d15a90117d343c4cb8e3c61235465e1c281cc49ef1b0ab620f241c42ab2ebfd36bd4539150343a9a43aa860618f3"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:32 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x4000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:32 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x100000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) dup2(r1, r0) [ 1767.876438][T20454] binder: 20448:20454 got transaction with invalid offsets size, 4 [ 1767.909059][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x80000001, 0x40000) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000100), &(0x7f0000000180)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:32 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x200000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{0x0}], 0x1) dup2(r1, r0) 02:04:32 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200) chmod(&(0x7f0000000180)='./file0\x00', 0x94) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000100)={0x1, 0x87, 0x2, 0x25, 0xffffffff, 0x400}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1768.042362][T20514] binder: 20503:20514 got transaction with invalid offsets size, 4 [ 1768.068111][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1768.159955][T20578] binder: 20577:20578 got transaction with invalid offsets size, 4 [ 1768.172062][T20579] binder: 20577:20579 got transaction with invalid offsets size, 4 [ 1768.224703][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1768.242191][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:33 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x300000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:33 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x81) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000040)={@initdev, 0x0}, &(0x7f00000000c0)=0x14) ioctl$DRM_IOCTL_AGP_INFO(r1, 0x80386433, &(0x7f00000005c0)=""/20) io_setup(0x1, &(0x7f0000000140)=0x0) r4 = socket$inet6_dccp(0xa, 0x6, 0x0) io_submit(r3, 0x3, &(0x7f0000000580)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0xf, 0x7, r0, &(0x7f0000000380)="bb73c127659e5b4e3d09944f55a3651ebc76f89947682b1dde66f0af80ca08bcb7ed8938fe9a6842b17e6e5d07768bc61fdea304e197d384da60ec1929d8afe80bfab7ad03656d9b02ecc3e04459805c2f327112ebbdb0faa0d6101b90d82a50976ab74b5ccc378925ebb7cdaa684e648642839786820e9e8e5bbee179eda786d8de403c5a0b00839d16bf4d042a63757f3fbade321e2c33239d532399452c5e5d00a556493a39901e0bd7a07e11a874dafc03b1d4fd05cbbc06cb62dcf14e0539f2fc23", 0xc4, 0x1, 0x0, 0x3, r1}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x2, 0x9, r4, &(0x7f0000000200)="25c13a03796db570377da286b6dd7a15a71fe51abb0f6826e64208c45b0349b8430a9ba9f46f1c6354142eb9", 0x2c, 0x9, 0x0, 0x3, 0xffffffffffffff9c}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x6, r1, &(0x7f0000000480)="8842dccfd8902a8d1dd192aa384d5734227e830114b72d6ebfa3ab0230b0d194217c328a3df6b478dd7ec54fe4e89c27fa5eab15c64546d60981104fc625fd6540ac65b9856352bafa828a72bc5626dd9feaca2fd95ccc46372df681068d3738f2dbcb33b2039760c6e62b6bdbc7d3877c504e8529e7f2a1fe5c3bba262fdae4ec538e37b04d8e640700afbdac3b5d6ac6a74fdc9abdd1fdb2ad652bf8f9951af77d8456179f3a3e8c623169", 0xac, 0x4, 0x0, 0x2}]) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000002c0)={0x10001, 0x5, 0x2, 'queue1\x00', 0x400}) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, r2}, 0xc) 02:04:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) 02:04:33 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xfffffe6f, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000009000000000000000000000000000000004000000000000000000020000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x400000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1768.825076][T20589] binder: 20586:20589 got transaction with invalid offsets size, 4 [ 1768.860382][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:33 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x80, 0x0) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x500000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1768.986546][T20609] binder: 20605:20609 got transaction with invalid offsets size, 4 02:04:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x800, 0x0) bind$unix(r2, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) 02:04:33 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x578200000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:33 executing program 4: r0 = accept4$vsock_stream(0xffffffffffffff9c, &(0x7f0000000180)={0x28, 0x0, 0x3, @my=0x1}, 0xffffffffffffff3b, 0x2000080000) recvmmsg(r0, &(0x7f0000004c40)=[{{&(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f00000002c0), 0x0, &(0x7f0000000300)=""/215, 0xd7}, 0x8001}, {{&(0x7f0000000400)=@tipc, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000480)=""/124, 0x7c}, {&(0x7f0000000500)=""/171, 0xab}, {&(0x7f00000005c0)=""/33, 0x21}, {&(0x7f0000000600)=""/21, 0x15}, {&(0x7f0000000640)=""/255, 0xff}, {&(0x7f0000000740)=""/74, 0x4a}], 0x6, &(0x7f0000000840)=""/134, 0x86}, 0x7}, {{&(0x7f0000000900)=@ipx, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000980)=""/162, 0xa2}, {&(0x7f0000000a40)=""/205, 0xcd}, {&(0x7f0000000b40)=""/142, 0x8e}, {&(0x7f0000000c00)=""/224, 0xe0}, {&(0x7f0000000d00)=""/224, 0xe0}, {&(0x7f0000000e00)=""/245, 0xf5}, {&(0x7f0000000f00)=""/49, 0x31}], 0x7}, 0x8001}, {{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000000fc0)=""/236, 0xec}, {&(0x7f00000010c0)=""/12, 0xc}, {&(0x7f0000001100)=""/127, 0x7f}], 0x3, &(0x7f00000011c0)=""/4096, 0x1000}, 0x7ff80003}, {{&(0x7f00000021c0)=@isdn, 0x80, &(0x7f0000003480)=[{&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/137, 0x89}, {&(0x7f0000003300)}, {&(0x7f0000003340)=""/237, 0xed}, {&(0x7f0000003440)=""/46, 0x2e}], 0x5}, 0x80000001}, {{&(0x7f0000003500)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000004780)=[{&(0x7f0000003580)=""/128, 0x80}, {&(0x7f0000003600)}, {&(0x7f0000003640)}, {&(0x7f0000003680)=""/4096, 0x1000}, {&(0x7f0000004680)}, {&(0x7f00000046c0)=""/179, 0xb3}], 0x6, &(0x7f0000004800)=""/101, 0x65}, 0x80000000000}, {{0x0, 0x0, &(0x7f0000004f80)=[{&(0x7f0000004880)=""/139, 0x8b}], 0x1, &(0x7f0000004980)=""/198, 0xc6}, 0xdd}, {{&(0x7f0000004a80)=@rc, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004b00)=""/246, 0xf6}], 0x1}}], 0x8, 0x2121, &(0x7f0000004e40)) r1 = socket$inet(0x2, 0x1000000080001, 0x84) lsetxattr$trusted_overlay_opaque(&(0x7f0000004fc0)='./file0\x00', &(0x7f0000005000)='trusted.overlay.opaque\x00', &(0x7f0000005040)='y\x00', 0x2, 0x2) r2 = dup(r1) setsockopt$inet6_dccp_buf(r2, 0x21, 0xe, &(0x7f0000004e80)="9f1004ea9c61c4466ac30ad789305ba2d01797fc1c9995877f63ab4505a86d41e76775d22a5be501ff5018746b89199f518972fa809c1a37a8e517540cbfc5c1b28817f2ac10386295023d0b7020a6d5fca653eb140391d98939dd8f15fcc4c6392ebd2fd9e0122ee3fd5039c0ecbb2b2de52c9093368a5940610531fa3f44539d676d2b82231681aa961b29558c3c37da9584211e6789281500d87a4949ffaef7af6d7c5d6e1ce2aaeb892832b70497c7e0ff935c77dd9fed56c5551fe94f6f15dc5795fb2635f5ae5f14e67967a4445b298442337158f944e92d0e00867f3898d410ce0235e2", 0xe7) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000000)={0x5, 0x5, 0x8203, 0x5, 0x960, 0x3f, 0x1000, 0xe3, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f00000000c0)={r3, 0xffffffffffffffe1, 0x9f, "1371eaac0f1558e638a64c645b52d42cbccfda343d408c191b220e5f8cae022760774075a5c76efc645243bd61ed223c3408e01a5e9d68650aa8d2dd3d631a9b08576d1fb70fe8dbe6c5172ebb0c2d07d88081f63bd2af5226e4062141bfb20e3ceaf8effcaa5b9b90259b7579e6c6b82b2d9260c02c697bda0ffc4db3bbb6e359b1723244540b513cc1ead97282c27e55629754fa453e0f00000000000000"}, 0xa7) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) lsetxattr$security_smack_entry(&(0x7f00000002c0)='./file0\x00', &(0x7f0000003300)='security.SMACK64\x00', &(0x7f0000003600)='!\x00', 0x2, 0x2) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, &(0x7f0000003640)={0x200, 0x9, 0xee, 0xe7}) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000004680)={0x2, 0x800}) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000004940)) [ 1769.149426][T20712] binder: 20711:20712 got transaction with invalid offsets size, 4 [ 1769.176485][T20712] binder_transaction: 6 callbacks suppressed [ 1769.176499][T20712] binder: 20711:20712 transaction failed 29201/-22, size 0-4 line 3201 [ 1769.224305][T20712] binder: 20711:20712 transaction failed 29201/-22, size 0-4 line 3201 02:04:34 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:34 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x600000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x0, 0x2) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000180)=r2) connect$x25(r0, &(0x7f0000000000)={0x9, @null=' \x00'}, 0x12) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000040)={0x0, 0xca6, 0xae2}, &(0x7f00000000c0)=0x10) 02:04:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x6, 0x10001) ioctl$TCSETA(r2, 0x5406, &(0x7f00000000c0)={0x3, 0x9, 0x3, 0x0, 0xe, 0x1, 0x22, 0x2, 0x5d26, 0x8000}) ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f0000000000)={0xffffffffdfa2e6ae, 0x101, 0x4, 0xa49}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000000000000390224c42951d8c413cce8a73d00000000000000000000000000000000000000000000000000ca000004000000000000000000000000000000d5e4b3f4f649b65ca7722e806c77abca171f72bffb73896ab36b41e77b19295d0b57be4fb70a0d246ea5facb39adecf2e218300b605c6fac791fccf915bb368cd3266b1db571a011c94bad3224f4c46e0c565e157cc1b79ab9a667ffb43c456843672651677c45ad36932474298edf892b5599448efba7adc44fcf0642f5ae735dcc9c200c0948b680687b783db84e14b5ef4adf73f95d456598b3a7ab7a4cdbc1a89060c18329bdd6ef89fa278b04aa8c76d2e6ffdc1ddd06091989e487eb1a3dcb13", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) [ 1769.699874][ T5] binder: undelivered TRANSACTION_COMPLETE [ 1769.706345][ T5] binder: undelivered TRANSACTION_COMPLETE 02:04:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x800000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:34 executing program 0: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000de2e460000000000000000007fe100000000000000000000000000000400000000000000000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) eventfd2(0xba, 0x800) 02:04:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x806000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1769.882637][T20741] binder: 20739:20741 got transaction to invalid handle [ 1769.934394][T20741] binder: 20739:20741 transaction failed 29201/-22, size 0-0 line 2994 [ 1769.963182][T20748] binder: 20739:20748 got transaction to invalid handle 02:04:34 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x82) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x10000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x200, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x28}}, 0x8}, @in6={0xa, 0x4e21, 0x1, @empty, 0x4}, @in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e24, 0x9d, @remote, 0x400}, @in6={0xa, 0x4e21, 0x8001, @mcast1, 0x8}, @in={0x2, 0x4e24, @multicast2}], 0x90) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, 0xc555, 0x6, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x4}) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:34 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xd00000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1770.008057][T20748] binder: 20739:20748 transaction failed 29201/-22, size 0-0 line 2994 02:04:35 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000002753527da5a6e7d87a26aa8fd55a57daf5555bd9a702bfda93f22e15f30a030dfe66f1cb6ca4"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2800000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0xffffff05, &(0x7f0000000000)=[{&(0x7f00000001c0)='*', 0x265}], 0x1, 0x0, 0xffffffffffffffb3}, 0x40000) 02:04:35 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x64000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(0xffffffffffffffff, r0) 02:04:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40a000, 0x0) [ 1770.544899][T20865] binder: 20862:20865 transaction failed 29201/-22, size 0-4 line 3201 02:04:35 executing program 0: socket$rds(0x15, 0x5, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7, 0x200100) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200300}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x90, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x81d8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffeffffffff}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4014}, 0x1) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000600"]], 0x0, 0x0, &(0x7f0000000300)}) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{}]}) 02:04:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2900000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1770.662175][T20878] binder: 20877:20878 transaction failed 29201/-22, size 0-4 line 3201 02:04:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f00000000c0)=0x4) 02:04:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2b00000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1770.719202][T20878] binder: 20877:20878 transaction failed 29201/-22, size 0-4 line 3201 02:04:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1770.955974][T20893] binder: 20892:20893 ioctl 5386 200002c0 returned -22 [ 1770.964766][ C0] net_ratelimit: 24 callbacks suppressed [ 1770.964803][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1770.965009][T20893] binder_transaction: 4 callbacks suppressed [ 1770.965042][T20893] binder: 20892:20893 got transaction with invalid offsets size, 4 [ 1770.970755][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1770.986547][T20893] binder: 20892:20893 transaction failed 29201/-22, size 0-4 line 3201 [ 1771.049817][T20896] binder: 20892:20896 ioctl 5386 200002c0 returned -22 [ 1771.065907][T20895] binder: 20892:20895 got transaction with invalid offsets size, 4 [ 1771.079518][T20895] binder: 20892:20895 transaction failed 29201/-22, size 0-4 line 3201 [ 1771.089773][ T5] binder_release_work: 8 callbacks suppressed [ 1771.089779][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1771.110842][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:35 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:35 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20480, 0x0) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x0, 0x4) 02:04:35 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2c00000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:35 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0xe1060000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:35 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f0000000200)={{0x3, @addr=0x4}, "76c46b57667ccf85afa623ac826e62b075cb9b047c8dffcc8eb513d06ff0bbea", 0x1}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) fanotify_mark(r0, 0x44, 0x1, r0, &(0x7f0000000180)='./file0\x00') ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) write$P9_RUNLINKAT(r0, &(0x7f0000000100)={0x7, 0x4d, 0x2}, 0x7) [ 1771.216719][T20904] binder: 20903:20904 got transaction with invalid offsets size, 4 [ 1771.254377][T20904] binder: 20903:20904 transaction failed 29201/-22, size 0-4 line 3201 [ 1771.280400][T20909] binder: 20903:20909 got transaction with invalid offsets size, 4 [ 1771.293455][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1771.300948][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, 0xffffffffffffffff) 02:04:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x2f00000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:36 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x5}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000000c0)={0x0, 0x73, "7ddde25683c5b5e92c995da8275d969f1cad1c3cd2e868b7f63e87722246de2043ea556748e00fb3b771cef1b8dfadf33e56bfea2ef8da712de95426989c6eb97c8edd1e1025a468c0a6ef7f0c3deeb497e1b7e951c63dcfcab3d116b5c3833f300900be7827436ee686364710b80e567a39af"}, &(0x7f0000000140)=0x7b) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000240)={0x0, 0xfff}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000200)={r1, 0x2}, 0x40b) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000000080)="800000001000000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53efad51ff30922479808b4cd8fcc14fdfb3f4fb4e913c8acc249699b8339731b1234f7104aca5ec2eb8d3db397c", 0x66, 0x400}], 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x2, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000140)={0x1f, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:36 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/self/net/pfkey\x00', 0x10401, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x82) r2 = syz_open_dev$admmidi(&(0x7f0000000940)='/dev/admmidi#\x00', 0x100000001, 0x800) openat$cgroup_procs(r2, &(0x7f00000009c0)='tasks\x00', 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f0000000980)={0xf, 0x0, 0x0, {0x8, 0x7f, 0xfffffffffffffffe, 0x4}}) sendmsg(r0, &(0x7f0000000900)={&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x1, @empty, 'bridge_slave_0\x00'}}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000000c0)="2d20180458cfb8eb357048f5d5b0506e6b6b23db1b47a664190996d1fe7a10601176fe9417280fbc68c21f41880bce61643c3bdb429608a7d2afc0c4622cc3936fc049798f75cfe0015c82dd5484addcb4035dc512b5da21fac4facd80cf3cd949c26efb19e966c5edd746254b56a89496eaa30e0c1ca580ca0362c195d9d5111cfd80442c924b63f7090db3be4f27d03ea850d80e9bc01450a5ec0c589c04", 0x9f}, {&(0x7f0000000180)="157c9e04a4deb18253e57167fe724c90812ef90f7891292ed591759d6e9a83c94faaea8bee92e3e2ad347f75cdbd24e2d8e322124cba06b09b737d3473", 0x3d}, {&(0x7f0000000200)="6fe189629751eed6078779899930b707b22cbd720ccdadd6b09a559028cb69a7b7a5c7859c57a1946b42fc0fbf4c074c9abd9c2c5f7fbcd200015044fef6d16993d5a1ced9430d92dcb76f8150685138a5eaf6f69f79a227430a83e2ea4589b53ff83f27f1422d101d7e9800b03c32362a8a6afc2724dc26dc85da", 0x7b}, {&(0x7f00000002c0)="ce67874b77b26d64a3ed045e3878d075988c318136f1d0b36b0dab497929bdcd2710d9b867668f7799b68bd145b83e5bf4843273a10dbe61a2c484dd4f8f7e37d489a4a66710a875a5f4720eadda10824d2794994154edd1770e2a7a4207061b1f68cd541662c66fd0b0a0f8d854beb284d930978bfa3ea503b2d366142d690c14e4cd07dcfc8479a45bd73410ebeef025fa997f072ecb58f7dd5513c4683d31116ef103f2fa42d7807eed655ed8cf59d469662fcd0af383ded8dc7cfa0b663a85b650c782142c22797d5aaa69230ba69b85edf8f3e7b9af1e3da235a00617bd771179934358db419a1e98", 0xeb}], 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="680000000000000019010000ff070000249c35a0dd5d4b3b825922e75c94251cb1352b58cf57f142a3921e16876e39bf03d848d8e2ec972149a946ae38758b4f3354478b220a63eb1c4f700d6226597aedfd084cae1b3efdc2e971edc0be24a2d961fc6c333b314f7000000000000000ad0000000000008044bc22ad82a819dba8be3376d1ea9c9c05c377d970bce29173337136d1ad65daaf051d5c29d75d35af116592b63cfda8b464bcdca39c11d41e906830d0145b322e3b773883ab0c7cda4ac2c77ac3da89c2929dea126b8b6b0656000000000000d000000000000000ff00000009000000bb9cd7658b0c5cf1c8c88a1d5e9972d9cecf32d315f1d7dfddba28220b67775b8b39a78525c41cbe3a36cec52a3d36064f2589174ab9ed2eebeda28a15883cbe7eb5daa8dd5155345b81a729f708d8afb9a2a32e95266cf634212a38ebc6e4716b6223194bf12e8529b0291a9182173f49bf515fb895d3163e8c14d74a5c2b4440b23b7244d813eeae457fe445c868be1096c9e79aaa7dc3c5e83a9ac37cc669c9a6d6903efefa6aae5f4ce7753d599f525b85e85407ada08eb800000000000000010000000000001901000030e3ffff10095a5fe278bf69e83900f934eeb4223573d131590a24ed4c12b7c8919e150ae196a959c2d5b98c717c848a05c504cf81defaf28fe7b44cd9da5b1ba64ee8b7c27ff72c52ba9f4bf961a08a39f221895bd4dd6eeb66766f5d48738eab4901c3cdcde023bc8a6ea626e33084db398985fc6c473db62e2f314826a60804b017c6fe44c10bf0445546b20293b3855a4c619a96075d7abe8becdbdc1c20883f908f01dabcb026e3bacc2b1b8061bc8092349ce7283a9425c56f1b8a5a70f85758f54f21eaf74c833d887d53244acb6874488e8ba2ca20c8228ba66c2aef034ce0a81b94402bdd660fe57f50150f4f420000f80000000000000004010000010000009f4e8bd01037875cf52bb1c22799fbcb4e4d6359d5c2eb02bf3bbe24985ca5613157a8f7259c0d4fb18e68af038010656620ee4c578b837c00be3cda667c705761a64c2543be0796ef6b1ee4bd696958702f6b4d8e8ddd1f961c9d2ffc4aafe377a82e11b1efcca85d870389412bc7091280326703f6db1a161ffffb1c9af50e19b3a2be7b47a2b44d5f852edadba0409bbcb32cfc1867b3e4385166e41f41ff10e389681fc0e14c142a25b365f7ec9859bc0eb031115f1e6d4a2afdc8179e3f4605d2a0a626d93fcc6a6bac5278cb2b1495a5a2a529e68643e2f1abff808842bb3e58fc019b210088000000000000002900000008000000dc2d4a9abf15704214c946cd2bf2c2d87b47a36a60007dc700f36cabdd6520fe315f9feb89a60b9d9b8240880d83c43f0b0088d69daed5d9b005baa36a60c46372c7209092cf19d11599c803727f47792f0cf67e8b5585ee2b5f0a2350a4d510aabd2b34794b6c1b25a72fcbc23948a958a3abb34c93450030000000000000000501000002000000cbb0a92845a0a4eeded15934e24b4fb5552537fbf8a20ce6fc000000000000004000000000000000010000003f000000c3404c71352c5978bec18fed1a7518cfd34a011e7664307db99fbf8df8728413a111e16ba7e907949fcb6d5bf5000000600000000000000000010000ff070000ba538544652a36577cdfb05e3b38b2a96280a8fc733a3bada75541ac8487a3fc9b44d5cff4bdd10b815ce8823867d1932f585ee552b8496b22ffa6ff44ef86f6f30fad8f0396c80527e192b263000000"], 0x4f8}, 0x800) sendmsg(r2, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000a40)="44728e867c1e0ca438872fd52f49b528cbbc7bec3fd73bdc531017e12719ff1c85c3a75db06a973b13932dc768823636278335036eba3ef3aa7348bf66d580dc2809329336962942eb3647e8b0619ff708e8b29e1e94fdbec1678d8403c143b9276738c60e0925e5d5ee881cdd44e6b37d25f1cc63a8fcad5d1b378a1bf0b8a160687b7c821d134a6eec4e0e914ef395d6376e2b00215f1ccf946e1f0c2d3f25c05e5e39ca6741e2de676cb75ed27d8b165b266ec3a4f3e99df14158bca95f7d5479b1250320c38b337704e7a4b10a739dea82064b", 0xd5}, {&(0x7f0000000b40)="9e6889534d0ebcd4fd2118e2779e42e3875f77da29fe119780919b2f4b11450ac1922e701e1b490191043a9ede2404ef454af2dcfc6ce0c2cbc3fee40c6a4a6caf5cd8d3ab3ff373540036c7585bfce30c1fd3512ad172a3c8390f3ba27c9a36b30fa5a2d1814ee7df4fc9d5a85d98104cdf55940e1b2ba6142301d5a01d92d60a44f5393c32e1362f36acf3ea90c92a1839254f13f0dcb9d2f73a82c72d7f8a1552a727db6a3d583791c703adce4fe6b4f1ba03f877e65ad0fcc4", 0xbb}], 0x2}, 0x80) [ 1771.558266][T20916] binder: 20914:20916 got transaction with invalid offsets size, 4 [ 1771.580802][T20921] binder: 20914:20921 got transaction with invalid offsets size, 4 02:04:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3578200000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1771.605445][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1771.614062][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:36 executing program 0: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, &(0x7f0000000200)={0x0, @src_change}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:36 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:36 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x100000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:36 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7f}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={r1, 0x3, 0x30}, &(0x7f0000000100)=0xc) [ 1771.696816][T20930] binder: 20929:20930 got transaction with invalid offsets size, 4 02:04:36 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x3c00000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1771.739314][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000200)={0xed6, 0x3, 0x7, 'queue0\x00', 0x439}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1771.849663][T20944] binder: 20943:20944 got transaction with invalid offsets size, 4 [ 1771.888852][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1772.004248][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1772.010081][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1772.015904][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1772.021658][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1772.324242][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1772.330083][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1772.335928][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1772.341679][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, 0xffffffffffffffff) 02:04:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4000000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:37 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = getpgrp(0xffffffffffffffff) sched_getparam(r1, &(0x7f0000000000)) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000180), &(0x7f0000000240)=0x73f9e60f38cfed59) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="c500000000000080"]], 0x0, 0x0, &(0x7f0000000300)}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) write$P9_RFLUSH(r2, &(0x7f0000000100)={0x7, 0x6d, 0x1}, 0x7) syz_read_part_table(0x1, 0x4, &(0x7f00000004c0)=[{&(0x7f0000000200)="bca27e643358b0d37bb3e45707d4741cb904fb06656c820408aefb6396efdbecda7c0026f703d7512283199a2201f3d341e5061d14", 0x35, 0x4}, {&(0x7f0000000280)="3468ec9fd90addecc65f5ae8f5cdd9bad96488664adfa17f21ce839a90304416459b614a22bff50b68f30d73e1b85c8a2b7593584595e271b673962e548800321f1ca0d929a639768dc0e89c61538f5a393da3b111890b0a0ac44b6dae10e6b87b2843077d291ce63f0fa45545e84516a261f9f72e7c41a9205157a71e028131ee7bc1f041ecbad8bc4d97e3c6164a", 0x8f, 0x5f}, {&(0x7f0000000340)="6d152350d389b6aa18fea548d0782098755a9d18dd97f5370df1f5ab537b83e6ae591082e5ade854165b08031a787b57bd76001134a441e17878c39741b61a91ae8287e362dc40b583838b167dd575c1dc7815b5bed22d49651eca8a2d52f2c5924f6a5421a833c0bece836135f25ad1b8192d67debd99f9a204d7", 0x7b, 0x1}, {&(0x7f00000003c0)="c9be7a0296deb69b03f7a9a187bb2068373b1fcc3c4d42cc1f90063ee0386ba28ee78e9d92c6c4d98350a03d499a419f33a3d3f80b22e9c755bc03efd37f0746185349362329ed82c8653f10f85e863964ae923b4771bcfc30d7128c08d024b432a81d4d3a35b69e0f60933c67e8b9746c0c22e626a713b146819448e6057ca6677f86ff6517139c4383906f27b776f489ab272621c146af2688363955e5ee2b7dbcc73aabf7e648cd53b91b26dc4c2292c831a953f635dec060828de82400a906dc4dc2defd57ca067404e4219d789dee6b637716845a9a92d44742615a8e", 0xdf, 0x80}]) 02:04:37 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x400000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1772.430698][T20956] binder: 20951:20956 got transaction with invalid offsets size, 4 [ 1772.458630][T20961] binder: 20951:20961 got transaction with invalid offsets size, 4 02:04:37 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x40eed526, 0x0) sendmsg$kcm(r1, &(0x7f0000000200)={&(0x7f00000000c0)=@can, 0x80, &(0x7f0000000040)=[{&(0x7f0000000140)="5560f36e2528f3a198194da011aec93a2ccb6c286660e4d191cc11d49c07189d88e75f209d2902906d366eb9a2d24d63839256c0c92ea049ae47d0a78389fac2695d7a0cf2", 0x45}, {&(0x7f00000002c0)="141cc5fed9df90a9944945c4f16f19a2aa7df4acc1cb5d3a1a2482f25aadf2ab22ebca256d1d3a2f1b4d68130d627c7a54ebed5e69921d431a0faa12a064dc6d9436bdecc2fa59fcb021d879530e630390fb8db9e7f484bda5570333cebd067ecbd1e2d91d1eff5cfdfab10bc2c8e1993413bda05bc1b70ef7e0f673e144614eee402b53f33976f2bb3c8a6f435c80423c1ecedf4ed49f5f38fc6288c88cd7abce1184f81ac8aa4465b5b9bd03e9", 0xae}], 0x2, &(0x7f0000000380)=[{0xa8, 0x104, 0x0, "da1901d2cce2c2f74646531673f39e120a52eb7aa1a5c69c39112b4526cd21d07d769c044a66d8dd613e8f3b70a1f1d5f61cf49b4b1a72e5d5b19d2932c53eac90675849c03b79fa5916b1441b28328778c40e83c8cb4cf240caed1f2a838691b52686bd321787b6e83e197027350dc5647665afae28727b47c709793c0e80451fdbb6d69b8cb5f76788951ca2c3e5eb91f8fa"}], 0xa8}, 0x4000050) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x4305000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1772.477254][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1772.488057][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:37 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000000)=@generic={0x1, 0x6, 0x83a}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) sysfs$1(0x1, &(0x7f0000000100)='\x00\x00\x01\x00@\x00\x00\xff\xfd\x0e\r\n\xc0') 02:04:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x6000000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:37 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x525d, 0x3, [0xfffffffffffffffe, 0x9, 0x8bc8]}, &(0x7f0000000040)=0xe) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r1, &(0x7f0000000100)=0x4) r2 = dup3(r0, r0, 0x80000) ioctl$CAPI_GET_SERIAL(r2, 0xc0044308, &(0x7f0000000140)=0x5) 02:04:37 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8000000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1772.689675][T20979] sctp: [Deprecated]: syz-executor.4 (pid 20979) Use of int in maxseg socket option. [ 1772.689675][T20979] Use struct sctp_assoc_value instead [ 1772.768264][T20979] sctp: [Deprecated]: syz-executor.4 (pid 20979) Use of int in maxseg socket option. [ 1772.768264][T20979] Use struct sctp_assoc_value instead 02:04:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) readv(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1) dup2(r1, 0xffffffffffffffff) 02:04:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000ff0300000000000000000000000000000000000000000000000000000004000000000900000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000e200000000"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:38 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x800000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0xffffffce) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x800e000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:38 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8035000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000000)={r0, 0x7f}) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10000, 0x80) write$P9_RMKNOD(r1, &(0x7f0000000200)={0x14, 0x13, 0x1, {0x80, 0x2, 0x3}}, 0x14) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0, [], [{0x9, 0x1f, 0x2, 0x1, 0x100000001, 0xe54}, {0xffffffffffff0000, 0x3, 0x8, 0x6f8, 0x100000000, 0x101}], [[]]}) [ 1773.317494][T20993] binder_alloc: 13398: binder_alloc_buf size 9895604649992 failed, no address space [ 1773.339792][T20993] binder_alloc: allocated: 256 (num: 20 largest: 32), free: 12032 (num: 1 largest: 12032) 02:04:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_int(r0, 0x0, 0x1b, &(0x7f0000000000)=0x5, 0x4) pipe(&(0x7f0000000040)) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000000200)="03c6813d587ff82109cea2defaf7dac03d09c925264f8e9a33732524057064a24e65c8c3d9436e7649f93b3313c2d2699ba5ee14c40efcd96c7d836a2514fa1f2414", 0x42, 0x40000, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0003000000000000"]], 0x0, 0x0, &(0x7f0000000300)}) r2 = accept$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000180)=0x1c) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000000280)={{0xa, 0x4e23, 0x100, @mcast2, 0xc5}, {0xa, 0x4e22, 0x3, @ipv4={[], [], @local}, 0xfffffffffffffff8}, 0x7, [0x800, 0x0, 0x4, 0x8, 0x5, 0xff, 0x100000001, 0x100000000]}, 0x5c) 02:04:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8100000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000040)={0x0, {0x3, 0x8000}}) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:38 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x3f00000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:38 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000000c0)={0x8, &(0x7f0000000000)=[{0x400040000000, 0x5, 0x4435, 0x5}, {0x1, 0x100, 0x7fffffff, 0x5}, {0xfc23, 0x87a, 0x0, 0x9}, {0x7, 0x4, 0x0, 0x9}, {0x7, 0xffff, 0x9, 0x8}, {0xfffffffffffffffe, 0x3, 0x5, 0x7fffffff}, {0x800, 0x5, 0x9, 0x9}, {0xab8f, 0x7, 0x5ae8}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000073000000000000000000000005001c8b57ee43710000000000000000000000000000000000000000000004000086c57a07833b0c00000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:38 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x86ddffff00000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:38 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x8000) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:38 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8847000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1774.227959][T21029] binder_transaction: 12 callbacks suppressed [ 1774.227975][T21029] binder: 21021:21029 transaction failed 29201/-28, size 0-1125899906842624 line 3147 02:04:39 executing program 0: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x400000008, &(0x7f0000000240)="0edc1f023c8901000062ed") r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x7fe) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x4000000802) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x400280, 0x0) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000140)=0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000004d8d5722"]], 0x0, 0x0, &(0x7f0000000300)}) fadvise64(r1, 0x0, 0x7ff, 0x2) 02:04:39 executing program 4: r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'bridge_slave_0\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x26}}}) r1 = socket$inet(0x2, 0x4, 0x8000000080) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x8, &(0x7f0000000040)=[{0xfffffffffffffffa, 0x8, 0x9, 0x823a}, {0x2, 0x101, 0x79c, 0x9}, {0xffff, 0x4232, 0x9, 0x9}, {0x9, 0x1, 0x5, 0xaa0f}, {0x6, 0xc038, 0x6, 0x9}, {0x582, 0x6, 0x3ff, 0xc01}, {0x6f0d1bea, 0x80000000, 0x3f, 0xffffffffffffffdb}, {0x80000000, 0x3, 0x20, 0x200000000000}]}, 0x10) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffe0000001bba0444b03000000ac14140eac14142bac1414aa1b614711b166c362990c"], 0x1c) [ 1774.401530][T21042] binder: 21030:21042 ioctl 5386 200002c0 returned -22 [ 1774.451452][T21048] binder: 21030:21048 transaction failed 29201/-22, size 0-4 line 3201 02:04:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8848000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f0100a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000062e90000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1774.806382][T21157] binder: 21155:21157 ioctl 5386 200002c0 returned -22 [ 1774.830906][T21156] binder: 21155:21156 transaction failed 29201/-22, size 0-4 line 3201 02:04:39 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x6400000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x14, 0x1, 0x100000001}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x4001, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8864000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f0000000040)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f0000000000)="073067322c00802fc72b9ad97b9f2b2a", 0x10}], 0x1}, 0x0) 02:04:39 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1775.012979][T21162] binder: 21161:21162 transaction failed 29201/-22, size 0-4 line 3201 02:04:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88a8ffff00000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:39 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000000)={'ifb0\x00', {0x2, 0x4e23, @multicast1}}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, &(0x7f0000000300)}) timerfd_create(0x7, 0x800) [ 1775.122791][T21168] binder: 21167:21168 ioctl 5386 200002c0 returned -22 [ 1775.168592][T21168] binder: 21167:21168 transaction failed 29201/-22, size 0-4 line 3201 02:04:39 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x88caffff00000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1775.208912][T21184] binder: 21181:21184 ERROR: BC_REGISTER_LOOPER called without request 02:04:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) [ 1775.282235][T21184] binder: 21181:21184 ERROR: BC_REGISTER_LOOPER called without request 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x8906000000000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1775.463849][T21296] binder: 21274:21296 ioctl 5386 200002c0 returned -22 02:04:40 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0xe106000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000300)=0x8d3, 0x4) ioctl$ASHMEM_GET_NAME(r2, 0x81007702, &(0x7f0000000200)=""/106) r3 = getpgrp(0xffffffffffffffff) migrate_pages(r3, 0x9, &(0x7f0000000100)=0x5, &(0x7f0000000180)=0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="989a4b85c0077124"]], 0x0, 0x0, &(0x7f0000000300)}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000280)={{0x0, @multicast2, 0x4e23, 0x1, 'lblc\x00', 0x2, 0x7, 0x2f}, {@multicast1, 0x4e21, 0x10007, 0x3fd2, 0x4, 0x3f}}, 0x44) 02:04:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0x3, @mcast2, 0x6}}, 0x6, 0xf4}, &(0x7f0000000040)=0x90) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='cgroup\x00') getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000200)={0x0, 0x1ff, 0x3, 0x5f90, 0x10001, 0x3ff80}, &(0x7f0000000240)=0x14) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={r2, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f00000002c0), &(0x7f0000000300)=0x4) 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x89ffffff00000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1775.618231][T21302] binder: 21301:21302 transaction failed 29201/-22, size 0-4 line 3201 [ 1775.634828][T21302] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20003 [ 1775.654438][T21307] binder: 21301:21307 transaction failed 29201/-22, size 0-4 line 3201 02:04:40 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xffffffff00000000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x1, 0x10, 0x3, 0x4}, &(0x7f00000000c0)=0x18) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={r1, 0x1}, 0x8) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x800, 0x0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000180)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r3, 0x8, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0x4005) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000000000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x338}, 0x0) 02:04:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = request_key(&(0x7f0000000000)='cifs.spnego\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000180)='/dev/binder#\x00', 0xfffffffffffffffd) keyctl$setperm(0x5, r2, 0x40200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:40 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x4}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0xfffffffffffff000, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1775.931549][T21321] binder: 21314:21321 transaction failed 29201/-22, size 0-4 line 3201 02:04:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x100) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000100)={0x2, 0x8, 0x0, 0xc0, 0x6, 0x7, 0x3ff, 0x6, 0x3, 0x3}) 02:04:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = gettid() r2 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x4200) perf_event_open(&(0x7f0000000000)={0x7, 0x70, 0x1, 0x81, 0x1, 0x4c, 0x0, 0xff, 0x2, 0x8, 0x7, 0x100000001, 0x600000000000, 0x4, 0x4, 0x9, 0x1000, 0x400, 0x36a9, 0x4163, 0x6, 0xb69f, 0x3, 0x10001, 0x5, 0x5, 0x9, 0xe7d4, 0x8, 0x7, 0x0, 0xb8, 0xe185, 0x0, 0x40, 0x8, 0x80000000, 0xc6c, 0x0, 0x7fff, 0x4, @perf_config_ext={0x80000001, 0x6}, 0x2, 0x0, 0xffffffff, 0x4, 0x6b9f, 0x7, 0x8}, r1, 0x1, r2, 0x9) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1775.995636][T21327] binder: 21312:21327 ioctl 5386 200002c0 returned -22 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1776.086687][T21333] binder_transaction: 11 callbacks suppressed [ 1776.086698][T21333] binder: 21332:21333 got transaction with invalid offsets size, 4 [ 1776.121408][T21333] binder: 21332:21333 transaction failed 29201/-22, size 0-4 line 3201 02:04:40 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x300}], 0x1}, 0x0) [ 1776.158874][T21333] binder: 21332:21333 got transaction with invalid offsets size, 4 [ 1776.167076][ C0] net_ratelimit: 16 callbacks suppressed [ 1776.167084][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1776.167156][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1776.167258][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1776.167304][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:40 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1776.322542][ T5] binder_release_work: 13 callbacks suppressed [ 1776.322550][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1776.338315][T21333] binder: 21332:21333 transaction failed 29201/-22, size 0-4 line 3201 [ 1776.373454][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1776.484236][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1776.490118][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1776.496071][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1776.501814][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1776.724298][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1776.730127][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:41 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:41 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) timerfd_gettime(r1, &(0x7f0000000040)) io_setup(0x1, &(0x7f00000000c0)) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000000)='\x00', 0x1) 02:04:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$EVIOCREVOKE(r6, 0x40044591, &(0x7f0000000100)=0x9) 02:04:41 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1776.896011][T21356] binder: 21355:21356 got transaction with invalid offsets size, 4 [ 1776.923909][T21356] binder: 21355:21356 got transaction with invalid offsets size, 4 [ 1776.938996][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1776.947879][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1776.955845][T21384] binder: 21352:21384 ioctl 5386 200002c0 returned -22 02:04:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x400, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'erspan0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000200)={@local, r3}, 0x14) 02:04:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1777.090129][T21469] binder: 21468:21469 got transaction with invalid offsets size, 4 02:04:41 executing program 4: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000000040)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1777.131080][T21469] binder: 21468:21469 got transaction with invalid offsets size, 4 02:04:41 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1777.178505][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1777.196186][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:42 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e24, @multicast1}, {0x1, @random="5b7ff76f3e86"}, 0x8, {0x2, 0x4e20, @broadcast}, 'syzkaller1\x00'}) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:42 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f0000000300)='./file0\x00', 0x2) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000340)=0xffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000100)) uname(&(0x7f0000000240)=""/154) fcntl$getownex(r1, 0x10, &(0x7f0000000380)={0x0, 0x0}) prlimit64(r4, 0x0, &(0x7f00000003c0)={0x8001, 0x1b85}, &(0x7f0000000400)) fsetxattr$security_ima(r2, &(0x7f0000000180)='security.ima\x00', &(0x7f0000000200)=@sha1={0x1, "c0523b6669223ae4f09d80b9d7b4b837cf61d98f"}, 0x15, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:42 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000100)={0x16, 0x4}) r1 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000000000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:42 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1777.846426][T21490] binder: 21486:21490 got transaction with invalid offsets size, 4 02:04:42 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = accept(r0, 0x0, &(0x7f0000000000)) getpeername$unix(r1, &(0x7f00000000c0), &(0x7f0000000040)=0x6e) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1777.901534][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1777.924310][T21498] binder: 21484:21498 ioctl 5386 200002c0 returned -22 02:04:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1777.949943][T21488] binder: 21484:21488 got transaction with invalid offsets size, 4 [ 1777.979530][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1777.998696][T21509] binder: 21507:21509 got transaction with invalid offsets size, 4 02:04:42 executing program 4: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x1000000080001, 0x84) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x800100f, 0x0, 0x2}) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:42 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1778.051419][T21509] binder: 21507:21509 got transaction with invalid offsets size, 4 [ 1778.052641][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1778.107176][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:43 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_tables_targets\x00') ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000320000000000000000000000000000000000000000000000040000000000000011d508fa8aa4b183", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000008a1f8a23680bf2936db8758085efaf7b4240615abf82f2e150ac6f6bcd322f756e9821d318847e8b615ad0f8acba4ad2b964b2deef893779ba77ac1c6ff2f4b06eeff0efb697ddaf297e69fca2dbb08f6bf2799d747c71f06751c9a08ee630191d74959b539d6f79706eb799ccbd98424eaf11376c59494917375268582c3801bc13e42351ca318e436719151bf9242e9f18d8f80facc7a22bbba37152f45c6a88b19ccd44cd3da362dca09230629cb1fb49b748dcb0792da730da43f48a12d2cb318c2fbd7518fb95503e9440f9"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:43 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000000)={0x3, 0x2, 0x4, 0x6}) 02:04:43 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6e1}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:43 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) socketpair(0x9, 0x296b7e792a91cc55, 0x7ff, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x800, 0x0) ioctl$KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000280)={0x5, 0x0, [{}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r3, 0xc0086421, &(0x7f0000000340)={r4}) recvfrom$inet6(r1, &(0x7f00000000c0)=""/87, 0x57, 0x22, &(0x7f0000000040)={0xa, 0x4e21, 0x1, @ipv4={[], [], @multicast1}}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x8001, 0xff}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={r5, 0xffffffffffffff80}, 0x3bb) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40000, 0x0) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000200)={[], 0x3, 0x1, 0x6, 0x0, 0x1, 0x4000, 0xf004, [], 0x5}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl(r0, 0x6, &(0x7f0000000100)="ce9149d080") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r5 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:43 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe98, 0x0, &(0x7f0000000100)}) fsetxattr$security_evm(r1, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000200)=@v2={0x5, 0x3, 0x6, 0x5, 0x4d, "d2c98cec828da10895afab5ccd20f1a16d9146dac75481a1fa0e4c5017f04e5b26ba80f87b659eb0cb3098066ec98113e8c5c952fe21444ae90489e0be99f0473997b57d0f4eb4ad86da2f5574"}, 0x57, 0x1) r2 = syz_open_dev$mouse(&(0x7f0000003340)='/dev/input/mouse#\x00', 0x9, 0x2002) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000033c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000003540)={&(0x7f0000003380)={0x10, 0x0, 0x0, 0x8215b57bab9fc42f}, 0xc, &(0x7f0000003500)={&(0x7f0000003400)={0xf8, r3, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gre0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ifb0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffffb}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4000000000000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xa922}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffeffffffff}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffffffffbff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfff}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4800}, 0x0) [ 1779.097813][T21552] binder_transaction: 7 callbacks suppressed [ 1779.097821][T21552] binder: 21551:21552 got transaction with invalid data ptr [ 1779.162839][T21554] binder: 21551:21554 got transaction with invalid data ptr 02:04:44 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:44 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f00000000c0)="6ce24ebb0ea84b46608cd41dfe8044e3771d3482b784bb6323c13b667dc332dcc67158712315d3118bbdcc06d75cd1325c04715b9be69aede507031cc061fa0fa02274ac165bad08aa39456b", 0x4c, 0xfffffffffffffffc) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000140)={r1, 0x1ff, 0x9}, &(0x7f0000000200)={'enc=', 'oaep', ' hash=', {'nhpoly1305\x00'}}, &(0x7f0000000180)="470322f3bca30c667e67a9e50adc9ae48577074bfdb1b151b1e9d4c451fcaa8e4bd73ca483f0c131fceb3a7e635f6b152e4c001ec9a4e0c2cb555ec6bfe69c68", &(0x7f00000002c0)=""/254) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000340)="1600000000000000000000e2900f4f59b6cd440477f67e551d735dc31675994690fd88e788a52af9475ddb9970417b849ea22292742ac5c969c57b0f3472b943619e1ce41c95a97862dfcad68019a5a84292525e6ec43cf1b88c3ff51461487dbeb45c6fb11c8bf24a546df17bb4d9b08712c97c20bfab13c5f595a399fe5e609deaedee1a81e507cbdb61000800000000000040e14ab843532cf8204ef4650fe3440062538018f00453f429923495dee1fd8423a5f303d797ff121e2d8cfb6bfcbf073798f815b7e19d03d419af3f41ff097118db0a5399e9c9a597004f3cf03929aac270d38402eb57decca021639acee40960dccc4573516a706ff60149a7b5f7bf4047dffd7f77763add59cfdb49ab628f73f934e94ad7000000000000000000000000000000e3d877fa8be5cc4667459d4bca2c3c29f015f386d38ad15894edbe941659ba975298f24337ffb7eb609b13b5e0f88e6b2ad88a79") setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000180)='TRUE', 0x4, 0x2) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000b000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000ebc45004a7264a49184668", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00002670ee720000"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:44 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1779.654539][T30760] binder: release 21557:21558 transaction 1343 out, still active [ 1779.662309][T30760] binder: undelivered TRANSACTION_COMPLETE 02:04:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:44 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) write$P9_ROPEN(r0, &(0x7f0000000000)={0x18, 0x71, 0x1, {{0x1, 0x4, 0x6}, 0x9}}, 0x18) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) syz_mount_image$nfs(&(0x7f0000000240)='nfs\x00', &(0x7f0000000040)='./file0\x00', 0x200, 0x1, &(0x7f0000000140), 0x1240008, &(0x7f0000000180)=',wlan1\x00') setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x1, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00000002c0)=""/191) [ 1779.715413][T30760] binder: release 21557:21559 transaction 1344 out, still active [ 1779.734364][T30760] binder: undelivered TRANSACTION_COMPLETE 02:04:44 executing program 4: r0 = socket$inet(0x2, 0x802, 0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@vsock={0x28, 0x0, 0x2710, @hyper}, 0x8e, &(0x7f0000000040)=[{&(0x7f0000000200)="2a0b950af1325a9301117987086550a9a62062fc8864fbcd530333cbbd811afb2822dfd4802433c85d60f10c965c7da54f1aa21c34fc1ef88b4bb3859732bf9e0c38192a19cc6b835cecbafad8505fe572082cace7f044c84181f7afe97ba8bba7f980c64c5de03920fd4fa0f81478360fd607acb8dca529f3d94fbdd18aa12861e7fc26b56dae2e1c2cef7ba1b11a722469c8884b05493aefa29dfb63067a9e5de4ae8111e6e0ee22f5cf9026668a021f478cf7c91f39691801fa238fa28fd9000000", 0x1}], 0x1}, 0x0) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x8000, 0x2800) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r1, 0x4010ae74, &(0x7f0000000100)={0x0, 0x3f, 0x4}) 02:04:44 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1779.819603][T21578] binder_transaction: 15 callbacks suppressed [ 1779.819619][T21578] binder: 21576:21578 transaction failed 29201/-22, size 0-4 line 3201 [ 1779.871056][T21583] binder: 21576:21583 transaction failed 29201/-22, size 0-4 line 3201 02:04:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl(r1, 0x21000008914, &(0x7f0000000000)="0adc1f0d71f7223331c8d2") fchmod(r0, 0xe1) pwritev(r0, &(0x7f0000000440)=[{&(0x7f00000003c0)="4657dfde200e5e41fea5fc77ccc7f1e93bd607f091f61c03b26167aea0dd341872573f0bc1fb8450a0642a576f8617bfd91ac769e4a096998f2ee4074bb635fcd331f0deab00defccea644c2da7b7a24b3", 0x51}], 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x3, &(0x7f0000000140)=',-\x00', 0xffffffffffffffff}, 0x30) fsetxattr$security_smack_entry(r1, &(0x7f0000000340)='security.SMACK64EXEC\x00', &(0x7f0000000380)='\x00', 0x1, 0x100000000001) r3 = syz_open_procfs(r2, &(0x7f0000000300)='cgroup\x00') r4 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r5 = getpgrp(0xffffffffffffffff) ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f00000004c0)={0x0, 0x4000, 0x8, 0x6, 0x6}) ptrace$setsig(0x4203, r5, 0x9, &(0x7f0000000080)={0x23, 0x4}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000001f47577b5117b9c885858ababc67a66cc839f07c74b4dc0600000000000000b3a227d93057395f06d972fc532f8a4e643308d8361cf047744e42ee477a7a70bbdda4bf8bd60fe19f4bd92c487e3f749cb7ec40954bb2e785acfd6c1658075f02d384ca07048a260a6846a0159adf0267ee615f82300fc68ec42036bc0ba8c1c8923886fa3eb8e84f9bc25a075597be4ab48d78fe365caf0add2bfa9383ff34af25f1c1384b0ff12b268142da5e40a0dbee79eeb000000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000100)) [ 1780.069530][T21691] binder_alloc: 13398: binder_alloc_buf size -6572800146344814776 failed, no address space [ 1780.112171][T21691] binder_alloc: allocated: 272 (num: 22 largest: 32), free: 12016 (num: 1 largest: 12016) [ 1780.144443][T21691] binder: 21600:21691 transaction failed 29201/-28, size 2233785415175766016--8806585561520580793 line 3147 [ 1780.194880][T21691] binder_alloc: 13398: binder_alloc_buf size -6572800146344814776 failed, no address space [ 1780.218218][T21691] binder_alloc: allocated: 272 (num: 22 largest: 32), free: 12016 (num: 1 largest: 12016) [ 1780.241248][T21691] binder: 21600:21691 transaction failed 29201/-28, size 2233785415175766016--8806585561520580793 line 3147 02:04:45 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80), 0x0, 0x0, 0xb7}, 0x0) 02:04:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f00000001c0)=[0x0]}}], 0xa4, 0x0, &(0x7f0000000100)="9029056f21642005000000515dcc5a58c3d45b8a8d4dc33ee49d"}) 02:04:45 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:45 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1780.551353][T21705] binder: 21703:21705 got transaction with invalid offset (0, min 0 max 0) or object. 02:04:45 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x8, 0x800) setsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000140)=0x7772, 0x4) r1 = socket$inet(0x2, 0x1000000080001, 0x84) signalfd4(r1, &(0x7f00000000c0)={0x100000000}, 0x8, 0x80000) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000040)) [ 1780.596669][T21705] binder: 21703:21705 transaction failed 29201/-22, size 0-8 line 3241 [ 1780.635596][T21715] binder: 21703:21715 got transaction with invalid offset (0, min 0 max 0) or object. 02:04:45 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x543, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1780.704359][T21715] binder: 21703:21715 transaction failed 29201/-22, size 0-8 line 3241 02:04:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008910, &(0x7f0000000140)="0aabcde7dc1f023b8f5621") setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x2, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1780.902534][T21725] binder: 21724:21725 transaction failed 29201/-22, size 0-4 line 3201 [ 1780.931623][T21726] binder: 21724:21726 transaction failed 29201/-22, size 0-4 line 3201 02:04:46 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x9b06000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x2080, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0xe7d, 0x0, 0x10001, 0xffff}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f00000000c0)={r2, 0x5}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x100, 0x0) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000100)=0x7, 0x2) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f00000001c0)={0x8, {{0xa, 0x4e20, 0xfffffffffffffff7, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}}, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000810cc55d165feeda3d3d6f82333c00"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:46 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xe106}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1781.364271][ C0] net_ratelimit: 24 callbacks suppressed [ 1781.364280][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1781.373313][T21733] binder_transaction: 9 callbacks suppressed [ 1781.373322][T21733] binder: 21729:21733 got transaction with invalid offsets size, 4 [ 1781.375814][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x608, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1781.436415][T21733] binder: 21729:21733 transaction failed 29201/-22, size 0-4 line 3201 [ 1781.474685][T21745] binder: 21729:21745 got transaction with invalid offsets size, 4 02:04:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @local}, 0xfe92) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x41, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) shutdown(r0, 0x1) r1 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x2, 0x2) syz_open_pts(r1, 0x2) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/exec\x00', 0x2, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x22e880, 0x0) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000040)=0x4) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x8) 02:04:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1781.504387][T21745] binder: 21729:21745 transaction failed 29201/-22, size 0-4 line 3201 [ 1781.568554][T30760] binder_release_work: 11 callbacks suppressed [ 1781.568561][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1781.584516][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x689, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000200)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x5, 0x10802) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000100)={0x6, 0x0, 0x10001, 0x8}) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f0000000180)={r3, 0x3}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x303, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="4000000000040000000b6300fa096310697a400000000000", @ANYRES64=r4, @ANYBLOB="0000000000000000106308400300000000000000"], 0xffffffffffffffe3, 0x0, &(0x7f0000000300)}) 02:04:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) [ 1781.731918][T21757] binder: 21755:21757 unknown command 64 [ 1781.773680][T21757] binder: 21755:21757 ioctl c0306201 20000040 returned -22 02:04:46 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x806, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000000c0)=""/212, &(0x7f0000000000)=0xd4) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0xfff, 0x802) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r2, 0x100, 0x70bd29, 0x25dfdbfc, {{}, 0x0, 0x4109, 0x0, {0x14, 0x18, {0x2, @bearer=@udp='udp:syz1\x00'}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x40000) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f0000000040)='*', 0x1}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000002c0)={@in6={{0xa, 0x4e20, 0x401, @loopback, 0x9}}, 0x0, 0x4, 0x0, "15b7fd48116ea1a56bf33ccc7e820f79154faded113a8e1079cc541c4074bba4e02e01b75d6d9d0facf5c7cd8adb170ef0e8c49cac9e26ec42af54d4bb57d30e7bd46f628510fbc4be48d6eed44c4930"}, 0xd8) write$eventfd(r1, &(0x7f0000000480)=0x100, 0x8) 02:04:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000380)="0adc1f023c123f3188a070") pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000003c0)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000440)={0x9, 0x108, 0xfa00, {r2, 0x5, "8598a0", "a68e8ee3f26066ea6c3c82189d754d4bf22585707ca553b49060890890f1b434d9a8a6aa65778ec08ff33bfeb35703508e82f3f309586a08b82e19ad3e769dea8c61d71d3edd0604801e94159fd3ff31c25edd3d67545538d5e161b55bc43bc5042bce95d997b76a79d10ada06db986d8844189f4a1a046cb0ae54dda2495f457689f266095e3d4e8232c9f1f60d0cee973f14836684c1164ecd06d9486c8f73af13303d6bff315c94852f5fa0f668d7753c06554f332678b9551f727df26c70c325ff82a3e0ca728e20dfa455addbedc471094504e4aa9ac6bae94d2497735e610bf5b934c1ac3346b385503899e99d440cbccc99de70231ff34f33bc62aa3d"}}, 0x110) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, 0xfffffffffffffffe, &(0x7f0000000580)) ioctl$VIDIOC_LOG_STATUS(r4, 0x5646, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) r5 = syz_open_dev$media(&(0x7f0000000340)='/dev/media#\x00', 0x888, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r5, &(0x7f0000000200)={0x9, 0x108, 0xfa00, {r6, 0xe, "0bc5ed", "760656987406e7eae264efc0521cbdf27628c1fe1540efef74f52c775dc38ebfa557867c43e1c68ca9e1b1e63a558b611b6bf22580b4fa95c78b49809a3d5efc534784c4c45796b2c5553342c2df20bc61940b28bb3e8e2467f9af7fe789705bd3cabb169dc0f0a8ef7e9f7abd3cdf324dca9543c19919c108af42a03bf26edfcf72dcb32a3d16e81d327f7bb2fd04d60bcd9014722302e95440709adc8bfdcd6381e2fb034e97bfb340448bfee387da5f238e13e4cb4e40bb6240009c12d4def41893c1bc702838c07a97556af4449704c71e5831b882b9f28d0678bd86726739c508237d1fd32934cd8ad42b6a03f182389f01f79939e012114abf427cefcf"}}, 0x110) 02:04:46 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x1000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1781.956463][T21765] binder: 21764:21765 got transaction with invalid offsets size, 4 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1782.009911][T21765] binder: 21764:21765 got transaction with invalid offsets size, 4 [ 1782.049094][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:46 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) recvfrom$inet(r0, &(0x7f0000000000)=""/24, 0x18, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0xffffffff}, 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x20000, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000100), &(0x7f0000000200)=0x24d) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioctl$IMHOLD_L1(r1, 0x80044948, &(0x7f0000000180)=0x80) [ 1782.058061][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:46 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:46 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xe80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0xf08}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x1ff}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={r1, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1782.191054][T21789] binder: 21788:21789 got transaction with invalid offsets size, 4 [ 1782.229310][T21791] binder: 21788:21791 got transaction with invalid offsets size, 4 [ 1782.299471][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1782.309278][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) [ 1782.414233][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1782.420117][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1782.425958][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1782.431828][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1782.465194][T21798] binder: 21797:21798 got transaction with invalid offsets size, 4 [ 1782.482277][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1782.724209][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1782.729982][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1782.735803][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1782.741548][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:47 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioctl$sock_ifreq(r0, 0x893f, &(0x7f0000000040)={'netdevsim0\x00', @ifru_data=&(0x7f0000000000)="fad406628e7a29cd3d65159482418b98d97d3a13b53d46f8e896d8605d60a526"}) 02:04:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400200, 0x0) recvmmsg(r0, &(0x7f0000003e40)=[{{&(0x7f0000000200)=@alg, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000280)=""/203, 0xcb}, {&(0x7f0000000380)=""/86, 0x56}, {&(0x7f0000000400)=""/205, 0xcd}, {&(0x7f0000000500)=""/228, 0xe4}, {&(0x7f0000000600)=""/191, 0xbf}, {&(0x7f0000000100)=""/57, 0x39}], 0x6, &(0x7f0000000180)=""/53, 0x35}, 0x101}, {{&(0x7f0000000740)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000980)=[{&(0x7f00000007c0)=""/2, 0x2}, {&(0x7f0000000800)=""/35, 0x23}, {&(0x7f0000000840)=""/133, 0x85}, {&(0x7f0000000900)=""/71, 0x47}], 0x4, &(0x7f00000009c0)=""/72, 0x48}, 0xfffffffffffffeff}, {{&(0x7f0000000a40)=@pppoe={0x18, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000ac0)=""/15, 0xf}, {&(0x7f0000000b00)=""/194, 0xc2}, {&(0x7f0000000c00)=""/165, 0xa5}], 0x3, &(0x7f0000000d00)=""/231, 0xe7}, 0x8}, {{&(0x7f0000000e00)=@ax25={{0x3, @default}, [@null, @remote, @bcast, @default, @rose, @bcast, @netrom, @null]}, 0x80, &(0x7f0000000fc0)=[{&(0x7f0000000e80)=""/32, 0x20}, {&(0x7f0000000ec0)=""/225, 0xe1}], 0x2}}, {{&(0x7f0000001000)=@generic, 0x80, &(0x7f0000002480)=[{&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/200, 0xc8}, {&(0x7f0000002180)=""/81, 0x51}, {&(0x7f0000002200)=""/113, 0x71}, {&(0x7f0000002280)=""/203, 0xcb}, {&(0x7f0000002380)=""/216, 0xd8}], 0x6, &(0x7f0000002500)=""/255, 0xff}}, {{&(0x7f0000002600)=@ethernet, 0x80, &(0x7f0000003a80)=[{&(0x7f0000002680)=""/195, 0xc3}, {&(0x7f0000002780)=""/15, 0xf}, {&(0x7f00000027c0)=""/70, 0x46}, {&(0x7f0000002840)=""/7, 0x7}, {&(0x7f0000002880)=""/211, 0xd3}, {&(0x7f0000002980)=""/224, 0xe0}, {&(0x7f0000002a80)=""/4096, 0x1000}], 0x7, &(0x7f0000003b00)=""/202, 0xca}, 0x9}, {{0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000003c00)=""/62, 0x3e}, {&(0x7f0000003c40)=""/39, 0x27}, {&(0x7f0000003c80)=""/75, 0x4b}, {&(0x7f0000003d00)=""/205, 0xcd}], 0x4}, 0x80000000}], 0x7, 0x40010000, &(0x7f0000004000)={0x0, 0x1c9c380}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000005280)={&(0x7f0000004080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xf4, 0x5, {"eeb90890160114974f835246ad9e5e38cfb39eabd75b31b787729e4cc0d394dd1098c7ca33c0b199ac7152441e27669716b0235df76b62644193721fd2200e98a6155154d2a723db6e1535d25640cefb17038c73b51403a85eec1af230811609067a1954388c1c6d533894fbca230757aa3e53ee003e9e8fbf155d0461acf70babbf647acea040bf8f1e0c1a3267bd2634019c933caee05cb276a486ed6507aa57f67f024cc76736b76d6aacdc8c4e007bd994b550998b4422e8f030a81a4664c93701883a6bd0176f4fcfd2acba701e24fbd93f054d77d1279a"}}, {0x0, "3536678024dee2a3c409a6a97b63618f9ace7946bcadb2a6b65b21f86cd17e89fe45599de4aa9b2c07fbeb65e5ad256d95e8e619a1a9a355b4ae7572f95a780c7b6e4b917e8338eee47045cffc932e6be59e43b8fd03e7fa86966aef4d3dd851e2358b702eda93be3687f14df013995ec653401ada9acd164e37a819081221f5975d473d1b99899630409b7f6881145adaf4f5f7111a3319aa8296e61315fd4bcef338d2f46f9428daced9a473fbf61cac10e6d1d9e8f496505e1c306ff0f8a79479ee5f289f27bfe2b03424d0fa41ae0e35dc8d87ad7bb41b698c1dd7bf2e36492b7d5d3abb9b5cb6"}}, &(0x7f0000004280)=""/4096, 0x1df, 0x1000}, 0x20) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000004040)=r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:47 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x4000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:47 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x12104000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x0, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f00000012c0), &(0x7f0000001300)=0x4) mmap$perf(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x100000a, 0x1810, r1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f00000002c0)={'broute\x00'}, &(0x7f0000000340)=0x78) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80800) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000240)=r3) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) ioctl$VIDIOC_SUBDEV_S_CROP(r1, 0xc038563c, &(0x7f0000000380)={0x1, 0x0, {0x92a, 0x4205, 0x3473b30d, 0x2}}) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1782.962161][T21814] binder: 21806:21814 got transaction with invalid offsets size, 4 02:04:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:47 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2b00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:48 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4004e24, @loopback}, 0x399) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1783.744622][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:48 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:48 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={r1, 0x1}, 0x6) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x50000, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x10800, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000140)={r1, 0x5, 0x1, 0x100000000, 0x8, 0x45d}, 0x14) 02:04:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:48 executing program 0: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x2100, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000200)={0x1, @default, @netrom={'nr', 0x0}, 0x5bb, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x984f, 0x8, [@default, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1783.886525][T21845] QAT: Invalid ioctl [ 1783.900827][T21845] binder: 21843:21845 got transaction with invalid offsets size, 4 [ 1783.941082][T21850] QAT: Invalid ioctl 02:04:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:48 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3580, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1783.965802][T21850] binder: 21843:21850 got transaction with invalid offsets size, 4 [ 1783.979141][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1783.987699][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:04:48 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x86) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:48 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x401, 0x40000) clock_gettime(0x2000000000000, &(0x7f0000000100)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000200)={{0x6, 0x4, 0x5fee00000, 0x5, '\x00', 0x9b82}, 0x0, [0x100, 0x1, 0xfffffffffffffd94, 0xffffffff, 0x8, 0x3, 0x3, 0x9, 0x4, 0x0, 0x63691258, 0x7, 0x4, 0x6, 0x5, 0x8, 0x44daf861, 0xfff, 0x253, 0x5, 0x4, 0x3, 0x0, 0x100000000, 0x84, 0xfffffffffffffffc, 0x6, 0xffff, 0x379, 0x357a, 0x59, 0x3, 0x0, 0x9, 0xff, 0x2, 0x10001, 0x20, 0x401, 0x9, 0xfff, 0x2, 0xffffffff00000000, 0x7, 0xfff, 0x1, 0x100, 0x400, 0x6, 0x4, 0x0, 0x9, 0x401, 0x80000000, 0x9, 0x3fe, 0x9e6d, 0x2, 0x7, 0xd479, 0x3, 0x4, 0x100000001, 0x18, 0x40, 0x6acfd0fc, 0x5800000000000000, 0x6, 0x60, 0x6, 0x4, 0x1, 0x0, 0x9, 0x1ff, 0x10000, 0x3, 0x9fe, 0xd84, 0x9, 0x0, 0x1721, 0xffffffffffffffca, 0x1ff, 0xffffffffffff7fff, 0x4, 0x2008000, 0x6, 0x3, 0x7f, 0x3, 0x5, 0x3, 0x1, 0xc2a6, 0x9, 0x8, 0x1506b953, 0x80000001, 0x6, 0x0, 0x80000001, 0x7, 0x4, 0x7, 0x8001, 0x8aa, 0x4, 0x81, 0x6, 0x4, 0xffff, 0x5e44, 0x7, 0xffffffff, 0x6, 0x8001, 0x2, 0x1ff, 0xe553, 0x0, 0x0, 0x0, 0x1, 0x7ff, 0x40, 0x5, 0x100000000], {r2, r3+30000000}}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r4 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:49 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x600}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:49 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @empty}, &(0x7f0000000100)=0xc) bind(r0, &(0x7f0000000140)=@hci={0x1f, r1, 0x3}, 0x80) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000000000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video1\x00', 0x2, 0x0) 02:04:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") fcntl$getown(r0, 0x9) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0063a4121d40400000000000000000000000000000000000000000e9000000000000000000000000000000000000000400000000000000000000000054945faa403974e6f310836a60715573d53b745282e842a699aff0d3f64cd59b514ad460c64b8d82c10cf361861a861e9d2f2be6c595324003cb740cd756e0b9f3", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snapshot\x00', 0x40, 0x0) ioctl$CAPI_GET_SERIAL(r2, 0xc0044308, &(0x7f0000000200)=0x8) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x3, &(0x7f0000000000)=[{0x1, 0x20, 0x9, 0x9}, {0x0, 0x7, 0x1, 0x80}, {0x6, 0x2, 0x2, 0x7}]}) 02:04:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4305, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) syz_open_procfs(0x0, 0x0) sendfile(r3, r4, 0x0, 0x50000000000443) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:49 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1784.886143][T22086] binder: 22085:22086 unknown command 312763136 [ 1784.924294][T22086] binder: 22085:22086 ioctl c0306201 20000040 returned -22 02:04:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4788, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:49 executing program 4: r0 = socket$inet(0x2, 0x800, 0x8) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1785.062668][ T26] audit: type=1326 audit(1550541889.808:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22085 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45ac8a code=0x0 02:04:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4888, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:49 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000000)='gretap0\x00') 02:04:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x6488, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1785.674753][T22222] binder: 22085:22222 unknown command 312763136 [ 1785.681033][T22222] binder: 22085:22222 ioctl c0306201 20000040 returned -22 02:04:50 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x69b}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = fcntl$getown(r0, 0x9) waitid(0x0, r1, &(0x7f00000002c0), 0x1000002, &(0x7f0000000340)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x100, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000240)={0x0, 0x80000001, 0xfffffffffffffc01, 0x2}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000440)={r4, @in6={{0xa, 0x4e23, 0x9, @ipv4={[], [], @loopback}, 0x2}}, 0x366, 0x4, 0x8e13, 0x4, 0x6}, &(0x7f0000000500)=0x98) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000004}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x6c, r3, 0x320, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xcb45}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3b}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20008000}, 0x2400c081) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x800e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="0adc1f023c123f3188a0c4a5aa70") r1 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x802) r2 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x3, 0x600842) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000000)={0x5, 0x1}) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r2, 0x10f, 0x84, &(0x7f0000000380), &(0x7f0000000200)) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f00000002c0)={0x4, {{0xa, 0x4e23, 0x0, @loopback, 0x10001}}}, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000400)={0x2, {{0xa, 0x4e23, 0x10000, @mcast1, 0x8}}, 0x0, 0x5, [{{0xa, 0x4e24, 0x3f, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xf5f}}, {{0xa, 0x4e20, 0x1508848b, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x9}}, {{0xa, 0x4e21, 0x8, @loopback, 0x4}}, {{0xa, 0x4e20, 0x2, @dev={0xfe, 0x80, [], 0x17}, 0x6}}, {{0xa, 0x4e20, 0x4, @remote, 0x4}}]}, 0x310) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000240)=0x4, 0x4) 02:04:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1785.866130][T22229] binder_transaction: 12 callbacks suppressed [ 1785.866146][T22229] binder: 22226:22229 transaction failed 29201/-22, size 0-4 line 3201 02:04:50 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x64000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8035, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:50 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x23}}, 0xfe3c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f00000000c0)={{0x2, 0x3}, {0x8, 0x3}, 0x9, 0x4, 0x1}) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1785.945590][T22229] binder: 22226:22229 transaction failed 29201/-22, size 0-4 line 3201 02:04:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x8000, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000100)="4c4ff1e0d5") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000180)={0x0, @speck128, 0x1, "94ae53f9169b723a"}) getresuid(&(0x7f00000013c0)=0x0, &(0x7f0000001400), &(0x7f0000001440)) syz_mount_image$erofs(&(0x7f0000000200)='erofs\x00', &(0x7f0000000240)='./file0\x00', 0xffffffff, 0x2, &(0x7f0000001380)=[{&(0x7f0000000280)="826f1c1545a5a801b485949b39b5144f377240f7cc961346378fc274c866d02c5c60d4005d90fea57c9d48138389075c63120c4d537d669bd0265d83b71e721920d8ca6b93765e9be40e72e43bf5ec8ebd007fb501d40f93966bd0f673319e8c162af1e7d85cf54946d9ba61cf4ac576b40e640574ccea12d1f20c886ddfd90fc1bc9c646832963211ae854a4258c36566af789371fc3a39470cd3109bc0d7d993e9c58b58f08fb5bf81c2557127f0fbdef2d1d31315f97554ed63e2c70b7bd28229a281b4be3544e6db24c7378f9c6e7a446b3bd3478672f16fafba4713d530f77c146950731b9dbee6675067903fa69a2387fedbea0d36c5e8924babde3d7ace8a5476fb04d912778a421ab5a3b54386615c986bd68b126e767762411380387a0925ef6ea22f95feeebab62174c1fb77b98b6a98acd1171b8fd83b1b25f21a8bede448685e4d52c5cfe228479abdef8218e47397e21e6a2b8156277edb5459f0edc4245f8d7fdf3e7e80774bc0cd50c75abea99d223d5843bb589f8972ca8f118318be05e14422972f171c0b85dbe86b2e1f7f9c5f0487f92ac1a62fb2d7c7116d5cb843009f685b76d6c475b3f00ebbf657c00e4cc39333acff8b32a53566b0f393a871504c9a3608f97c7049497661f4304efc61b0469a0436b6f56ab4471b99a9901f2cd59f36e4969986d62e836013eda7f3ce0fa012737e3a87c7c82aecac0d38c645819433d6e05207c05e40991e3fc8013b65b393dd6dd7a76e35c3d92023a6510022107c74c3c75322e900f19108aaad7a4f11346811885ad16d258f250c8480341e0cab47b4685519b849709f875a0812d2626d1ee3746c6e7b405e9e2d291840e4d3efbf1c90dd922b8ccc31e591bb72d3b66e01f249de1ced2ab09b5b1b399cc7baf68ccfdc2891ce2ea21ed16b3b6c7d1448f5b2ce3b7e9efcc03599b3f5fafae9956b0efd9b1b4094c790225e8c539435d32b6c49f6133f0739acdd301d0496096dee0dced6f71bea7515f808755b631e8d4291675c4a590b33fd5898809394c1f5204f790fb9cf1bf7932d1b8d59651cac09f431595dafc26d259e46978383ce22d5c9f06178c3a61dbe7f204ec0bad58297b8a85d8292e06a3c9ff48636804b8eb7a5a46744ddaf08455cf7edd873137f2b2e0ada2952e07d06fa581ec8170ef79cb879189a7707491624e86e8e6be4f43e925f46939487d3c515825fe12449edaf38991821b102a1bb379900a352534967225ea35dcba596f1215334ea08d2a428b714bea01765e33b06f4c80bb4e349cec7ea011aab5a1b876639c989bf42e42a1dfa69f96e2114a4a831951464256bec938dd8f07431828cb582ec0c32d2b454a3b80ac4630762f7567b525b5cd9c5c68d9741a0872c6e8dd3fee9b97dfa4da55f9dec3732c43a527df5f7841a8debb6c77e2be780e188544b711c2cc1c19282cd69e54a6c6ab9c5e6ad935b17b77b2161fb9597de749ab066f0719b5bf1de7b1429f1a7f9f4d49b8a9c56377d1b50c56d9a0f1c8cf849b2d67b23c278a9f816c5b5e009acb2f46badee272d692a8276d74041e0c463b4574eeb2df0239ebad5919920a4d42ea5138e16bec494b7275b87e0084ee58b22c561889a22b3cfc70c2e75808d5ebc369e9ccece83fb3d3ab6b012e62bc5a68befc08729e7175f2afd361d04b9631bf9a2e16e4b9beb2c60c89f8969e539ccbf42cec0727ae754e5887c701f047c4163671e70f5bfc2a0d4a79e82d4f8ee14a2bd1390181a15536594a2b52810cf294a3ff80f6b67cec6ef00749a1b8a33f3fad40673eff26eaff9fab362996c7c4871abb2d8c4b06294ecffccc47c2452a51797f504b2296585a588f037f3b181548993b9db4cd4b9e9336fe270744bb32df22d330b2feaf8723c9f3e7d53df37838c77cd63d588df24b3ec481e1390cc1ad892b14571abfc8bff4b6638b80487e12133789dabe8c5a536737eef1cb2853e6b4508154d3f0f236ecc00ee24e6feedd17fbc4f610d3633faf617099fd26ddcc331f7bb97e591f3d9f330c8ac5d330ebcafd72e1594cc0c9ebc5d7db0984037e10f25405070e5d9dc9961b8ab1ae7db87f7dcce64c4cd31bb07e620ceeaa9123384bb525bfd9167c88bbc5c22ec5dd150a9b1dc9ccdfd5e212c7fa3d0d36beab0b179c2982ba9b2f10dfadd938aac4897a3059c875418d99b8c878c530e9dfed5272e9fe4f78317e890b8d788e02bb49d6d12485f0e032a4b331f31d87addefe15d92a394cacf078e920dcfa8a710ed7f6f232b8f4978e429031d6a64d3c0c0d7d7e8e990964a72a681562d687ffb85dfbf4044a1886377ac6047fccf977922928724e93807d9a3214a9c6f9716a75ad9f6e25e4ccb5b5fe8dc670f0ab0de48a0a7fbdf11d9b72f49bfabf8124c856147701f1ee9000f1369b13371a970c0e7650b9a051f383286e22f557d2284c7e64a6f26e405e4280c35637a6a0790a60aa0e97f76f11793953dea7d66ad2ca7e0b1d05389d5573acc1e799da287e792e9c11030dac4b42d275c584a835d33ef648d9220c45e84570a7a909663c3cc566b8a656378166fa9fd6117fca791cf500066f398235ea79757bf86128ccf76f5ce72b0fe2b62746269bfede84842a7a3282fda6dfd0a6390bf08032d295adc9a0ac185e2131dfdf972dfdd66b7d6e11c326b8ab0ad9af32b36727245d351ba25121cd5c3f26e060d09009d973aad51eb02b54c6370bdf2f00d1304bb11bb4a4399880d011249453e97fe275abaee42346bbf6d0bd068f1fd6b1c92debe89df665ef4f8b691c9e68b0f5fcfe9ec763152e21bdda846eee4de69f9601f7130a8c3322c52847423150797d935529e50057e77895c38e184284a8e8b55f31c391b086a11a88bea6f674a14c04e4249ffbaf64f99983f456e90c0cbe4bad6fa1c9e6bd174b3d27035435e34a3dc49417eaaa7de636634c83ce4a065054737ca913ae283852245f420f00e60e27be335782d484577238d9af860d383963e90b81bad9254daa89d0528b41581cc02e0c0b3062431adc7216a6735d794fe666ab9c573e0f1599a2994a41d0a14c72a49cdb37d6fc2802f1d23017231593c1fcf70b58b41cd5f47eff83a8dfa7fa020d363b8cb38c308ab38905cc12a689b1c91bf8eaf020b43a8579b67b264a4ec72bf473e8464451d353d571a2c5e3870a6cbb984ef53e56a3fc7e14dc888ffb396d0b687d7029d280fb1d03f7e75f07340455d4f2f4d1e1e843c4aba3c57944e374d0668be7d50da31c674eb7f7bb3c5f4c0ebbac0a15c5b349e5e7ea117a3fb3938f87ee385b5409a97d8555d5093981d4650d125b548c8e3dd25dfd079de4f82aee5f7381b9353d9ac1b4b5bbd2cda801d6a1d0b160956a7fe514e258830dce0c1eeec0b121fe6fa6dfb8a80be90126266a48d0a72af97113f38d9103338acfb0dfb89167446e4f2bd883c3c75c99bdab71944a94be1727e5a809763dbf0462467111759b471a7cc45f95bcb4c0282cd4a2d3f52d6fa49eabf568e5533094502d368a0aae16e96f355f18e93e9d617324511026396801ae127ab5d28355ed508e1780b6ff20831cdb085d43ed59c036ea78b01cb718baa2922fa167e167418cefb349f839a0d8c2955a53cb8a773262df6d6e5ce1c714891c3905b768eda82afe0361d0ca3bc3a047a8d435d0a11031aab68a04115b108c50ebaed5df42ac9eabc97554f9c3ea400c4614e2a5f0533439fe70000a32d3cdfc31b8295707d7b1cca1d24135bafa296ed6de20ff16ceab2dadd8c58dc86d2b96aa23fe8b5626c5ba3e54e35e9d516cbd97c1c7a763880e4c69f366c99f9692ae6de784a9d58457e0f30478ceec305ff1853e06be7712ed7dd83beaaad8e1944d26ead714d1804638efd33648483c26b55268b66ea326fafbb99db809b3b08bf88fa0f99a7b10161fff98e712516af3804291d8e81727ea47897044d3d524f20c6ea12cebe76bdd6d25f563a8e7937e3ba7ebb40e6b290a98d89e3a18fddb5e3c5bc57a05d93e6e674355a491439a685e8debdb9affe814e69652670f20dfc01e5c855cc5cbea7d3d13340a3df3ec1b9954e39634d686a0f470cc6a36ebbc3e14a7e9da5bfae3c814907a57d507d5f0353ae9bfd4835713b0884ddc66fb6e440f56c0ff9b3eca623ab59c1110d1d206a91bf008f7c4d80b3ab750a037db1b8f3f1b94d9658c5bb2ec9bed851ffedd31545313a367778d862e82c3b5e95456a04516779689cc452f0c5ca8fd0ca938886405dee6c015f7a6b071c07a5131c9502a32e37bf9e962e7dab45af50c7802dc648c4378463428bb87b44a2da5298940ab89c8df97fc897e6b690f0b8bee41f951a22b65ed04043070412b22c35d764f63949d4ef492cb464112d34c50f25d10ad4544f417774c52cf87698f1ca2f1bce314607f317850662c774d4187823dbac86b9072b68602d4e5fd3feb22f8a67e3b3accc50d765376543e69061b0fae4188686374419e6db33572fd6c1ef990e2293af2529d8cbe5527125918182a9ba5ece38c9190ab607518c4c9bd7c316e22f257f1cf5b945373d4a01c5a64222b27c543fe3ad9c8b095a15c9bf7b7e3ccc9730c8c7aab3f394a2800d3f960d37db587133776ad587772dce52226c569d4cf3297f46a4ce6ebb1e515651f07a29e76f7fc0a8adf71f7bf51de1b1494a30aa13a4c10fd4dda8c19ae9c2d0919d5898ad5d9908746bae9f746a743a9d46d729f103c7930376d5a3d104377637b0f842b91dc5afbf22b9db70fdedaed00018e55905e4eef7f278d6c52687e8be08796820f84fd48965952a7ff9cbc1126ac843a2979888c5a12637ffaeb60d8c2b666d22616fecb302680fc4ef2788203e65ddaad4dd2794d800cc5068b279ebfb961ff7015168d52859194eb79796838e7fab9f27230425d8b28ad985ccef7a1584d0787d5ee26a5e24547f4911a534610504fdfbf2e5a35bd80c5261bb4710f9dd3f2045cbc50fe0252e9d275ed3af4df278d1c4812c2b577baa22868f6330897707deb32a0fc2f14f2267945b5acfa1321cd828cc560173b24d44b3f532b1361d46ef45def7874cb50ba9c7242065d7085cea15d601a439bd9e643ff9450431cf5e694ff2339563f141abee0bdc8a5346fae5e855854e55503686b5ad3d76502dde2e1e3c68513a7d315109c8613b579c8420bc85485451fc7ce00fea837ff7895d5ec44df75805e42d3b1261e34363905da76b365f36dfb7cc21f223ec98451070b2fe241f9e099e2cc4c601a3431b1764503d0844805b2fbbe0c38caf0fa66a2b31592e4f6d860500e9ac837e1e047d6784244aafbad0958a9866da72552e461d8a833236ff89370c6482387d36a90800d2cf6bf59edbc577a0c3b8df5659075046098d9a37e15ecd366e216626476ca62c5dcf20c908288c6d6859029cf253af71170c79f28c7c0d630e7370b1ee02b477b70c89ab7ae1588bb707bb2e9db360ce1d8d41d72bb0ea6cb662669ca17ec288e9959602041f10920140fc57b43bb579a691037d6dd046536867f688a6fb4182ef2e1046fafb181a13da5aff93ef4ae2b9c5fab302f071e6554a88ca57207b612557516e2da9b632728899933ba54a7a6d1af581efbb27ca0ea1f4ecb02b6a7596ec1b1117df64534baebfabbd83375da01291aa1586afb5ab849e1ad7ea0cc2cae2f4f093bd04af9fba10aa85729fc9f311feb222df5a79c0eefab1bb0cf1f268abc70fff56877516fc2378ccc9ff012437411ef7f4142f37593b6dd504", 0x1000, 0x8}, {&(0x7f0000001280)="6c3753035e9c7bab17e4248b403a7fed5da7d67e0d8d64a2f750aa63fdafd5cb99cf6e1e5583698e2d22fa427d1c69d0a97f7fe98ab609201684254f4ab89853d6d270fc1a92ef13a85c75b3f85887512686a4ee5b109e8ad113de46fd92762fba15f9499a192da5ecea8661e6b65dfb05a5df3f333f3108f0d960b8bb693371a055b1df9b4eb999b58aca5359edb55f6f55a43d4f13ecda368b33cff3684bd22642dd774c17441a8e5989b1ff3e558e49306e1badea174842a4f4e2e866e2a79267bea02f0495a33548d010c13afad5c1f8161183fd733be21a0a005347dd69ee004c9dac8640c12c", 0xe9, 0x8}], 0x810001, &(0x7f0000001480)={[{@fault_injection={'fault_injection', 0x3d, 0x3a}}, {@acl='acl'}, {@noacl='noacl'}, {@user_xattr='user_xattr'}, {@nouser_xattr='nouser_xattr'}, {@user_xattr='user_xattr'}, {@noacl='noacl'}, {@noacl='noacl'}], [{@appraise='appraise'}, {@func={'func', 0x3d, 'POLICY_CHECK'}}, {@fsuuid={'fsuuid', 0x3d, {[0x3b, 0x0, 0x38, 0x30, 0x77, 0x63, 0x72, 0x76], 0x2d, [0x66, 0x3a, 0x74, 0x61], 0x2d, [0x31, 0x77, 0x33, 0x77], 0x2d, [0x32, 0x62, 0x77, 0x66], 0x2d, [0x77, 0x37, 0x37, 0x77, 0x77, 0x39, 0x34, 0x31]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x31, 0x30, 0x38, 0x35, 0x7f, 0x77, 0x63], 0x2d, [0x38, 0x0, 0x62, 0x36], 0x2d, [0x38, 0x63, 0x0, 0x3d], 0x2d, [0x38, 0x64, 0x77, 0x7f], 0x2d, [0x64, 0x77, 0x62, 0x64, 0x7a, 0x73, 0x0, 0x65]}}}, {@smackfshat={'smackfshat', 0x3d, '/dev/binder#\x00'}}, {@uid_gt={'uid>', r3}}, {@obj_user={'obj_user', 0x3d, '#ppp0'}}]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:50 executing program 4: r0 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x8, 0x284000) r1 = accept4$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x80000) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000200)={r1}) r2 = socket$inet(0x2, 0xfffffffffffffffe, 0x2000000000088) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r2, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x20000) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x9}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000100)={0x9554, 0x0, 0x0, 0xffffffffffffffff, r4}, 0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000240)={r4, 0x1f}, &(0x7f00000002c0)=0x8) 02:04:50 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1786.103663][T22250] binder: 22248:22250 transaction failed 29201/-22, size 0-4 line 3201 [ 1786.158324][T22257] binder: 22248:22257 transaction failed 29201/-22, size 0-4 line 3201 [ 1786.564275][ C0] net_ratelimit: 16 callbacks suppressed [ 1786.564284][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1786.575813][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1786.581655][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1786.587442][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:51 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8847, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:51 executing program 4: clock_nanosleep(0x1, 0x1, &(0x7f0000000000)={0x0, 0x1c9c380}, &(0x7f0000000040)) r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0), 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = add_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000200)="584b301a9cd6ad63f86eaac6b9b3147ed127a6070e862b549f025d29d6fa11e6aaa46fcfa19463cf2b3812d5fd58d0435e68eb27739ce1fae5f2d382df5c9e77bdff539588974eab731afd0b8343d184633ebb22c30bcedf0525d36a27c950ad27953d11dceb043cabf7142755c728df4253a4c82c1b438a34c25a5cda0fc07f447711bf43c357d039a675bedbb1c4f27197ac4c38c7c070d5a11db430b4c69bab48a7c55448ebe867460427a839b0aee683ba9e5143c4a5c3d0b95e44d64d743b654d9169aff8e80a42dd6ba71fb2f5dec1e1", 0xd3, 0xfffffffffffffffc) keyctl$get_keyring_id(0x0, r1, 0x1) 02:04:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x440800, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000100)={@remote, 0x0}, &(0x7f0000000180)=0x64917412585c427e) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000200)={r3, 0x1, 0x6, @broadcast}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="a8b91d257cf4698e0d41a692e66cb5cc092600000000"]], 0x0, 0x0, &(0x7f0000000300)}) ioctl$TCSBRKP(r2, 0x5425, 0x9229) [ 1786.884237][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1786.890075][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1786.895951][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1786.901822][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:51 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xe1060000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8848, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1786.969821][T22267] binder_transaction: 8 callbacks suppressed [ 1786.969832][T22267] binder: 22265:22267 got transaction with invalid offsets size, 4 [ 1786.998381][T22267] binder: 22265:22267 transaction failed 29201/-22, size 0-4 line 3201 02:04:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8864, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:51 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = syz_open_dev$audion(&(0x7f00000003c0)='/dev/audio#\x00', 0x10000, 0xc0000) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x7) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000400)={0x3, 0x1000}) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0xfffffffffffffffd}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) syz_open_dev$radio(&(0x7f0000000440)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x70, &(0x7f0000000200)=[@in6={0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x13}, 0x50e}, @in6={0xa, 0x4e24, 0xb, @loopback, 0x633}, @in6={0xa, 0x4e20, 0x1, @remote}, @in6={0xa, 0x4e21, 0x98d, @dev={0xfe, 0x80, [], 0x1f}, 0x6}]}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000340)=ANY=[@ANYRES32=r4, @ANYBLOB="3200000052d5b3fe0a8595762c1462585d1cb68503ec1819f304d6f4fb76af171d8ec60a1432230097d880d5c958e1c0d6e3b68c0296"], &(0x7f0000000380)=0x3a) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000000c0)={0x0, 0xab, "f76d9a87fef55dcd6dbf0d80931e8d7dffa3358bf037d69e7cc1a3dbc06cf69a81c34f2bad3783311074dc560c4c0646fc10e98bd3c7f3152ff2c870a39ec2bc83f40c0fa2c71b0866511707160c8ba39a34a581b135f54070e4ba58bbd5d4814ac8a73d99961c857d2068c3177085a5075826e4b27cadb26abd787bdebb2612b63b3b5d4aa8a7ea809359963d8b1fb7b04d5cd9afc387062ff47a998d15031f671b97e9ebe348b69b9a4b"}, &(0x7f0000000040)=0xb3) ioctl$IMSETDEVNAME(r2, 0x80184947, &(0x7f0000000480)={0x1, 'syz0\x00'}) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000700)={r5, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xe}}}, 0x1000, 0xc0000}, &(0x7f00000007c0)=0x90) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000004c0)=""/245, &(0x7f00000005c0)=""/96, &(0x7f0000000640)=""/92, 0x2}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000180)={r5, 0x3, 0x7}, 0x8) [ 1787.055150][T22382] binder: 22265:22382 got transaction with invalid offsets size, 4 [ 1787.110808][ T5] binder_release_work: 8 callbacks suppressed [ 1787.110815][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1787.124567][T22382] binder: 22265:22382 transaction failed 29201/-22, size 0-4 line 3201 [ 1787.125375][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1787.138945][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:51 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8906, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1787.155773][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:52 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x31) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x50000000000443) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:52 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x3f}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000200)={r2, 0x8001}, &(0x7f0000000240)=0x8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x1c}, r3}, 0x14) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xf000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1787.889020][T22401] binder: 22400:22401 ioctl 4004556b 31 returned -22 02:04:52 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x100000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1787.938750][T22408] sctp: [Deprecated]: syz-executor.4 (pid 22408) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1787.938750][T22408] Use struct sctp_sack_info instead [ 1787.956582][T22401] binder: 22400:22401 got transaction with invalid offsets size, 4 02:04:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x207805, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x50000000000443) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1787.990250][T22401] binder: 22400:22401 transaction failed 29201/-22, size 0-4 line 3201 [ 1788.034523][T22414] binder: 22400:22414 ioctl 4004556b 31 returned -22 [ 1788.054264][T22408] sctp: [Deprecated]: syz-executor.4 (pid 22408) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1788.054264][T22408] Use struct sctp_sack_info instead [ 1788.060277][T22416] binder: 22400:22416 got transaction with invalid offsets size, 4 [ 1788.081016][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x50000000000443) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:52 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x207835, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1788.179264][T22416] binder: 22400:22416 transaction failed 29201/-22, size 0-4 line 3201 [ 1788.239293][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r1, &(0x7f0000000180)={0x10}) syncfs(r1) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1788.426253][T22530] binder: 22529:22530 got transaction with invalid offsets size, 4 [ 1788.485856][T22530] binder: 22529:22530 transaction failed 29201/-22, size 0-4 line 3201 [ 1788.531590][T22531] binder: 22529:22531 got transaction with invalid offsets size, 4 [ 1788.560117][T22531] binder: 22529:22531 transaction failed 29201/-22, size 0-4 line 3201 [ 1788.613243][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1788.620696][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:53 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9b06}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:53 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00000002c0)=""/142) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f0000000040)={{0x10001, 0x9}, 0x44}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xf0ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = semget$private(0x0, 0x2, 0x8) semop(r1, &(0x7f0000000000)=[{0x0, 0x905, 0x800}, {0x1, 0x4, 0x1000}], 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = getuid() stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r2, r3) r4 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0300000000000000"]], 0x0, 0x0, &(0x7f0000000300)}) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x50) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000180)={0x2002}) 02:04:53 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x400000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:53 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x201}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1788.944612][T22542] binder: 22540:22542 got transaction with invalid offsets size, 4 [ 1788.981431][T22548] binder: 22540:22548 got transaction with invalid offsets size, 4 [ 1789.024418][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1789.030697][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x2b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00 ']], 0x27, 0x0, &(0x7f0000000300)}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x10000, 0x0) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000180)={0x1, 0xfffffffffffff800, 0x2}) 02:04:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:53 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1789.189100][T22563] binder: 22562:22563 got transaction with invalid offsets size, 4 [ 1789.230032][T22563] binder: 22562:22563 got transaction with invalid offsets size, 4 [ 1789.262875][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1789.271611][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:54 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:54 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) fallocate(r0, 0x4c, 0x180800, 0x6) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80001, 0x0) 02:04:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000890f, &(0x7f0000001a00)="28479e4a6a5e316db4f9d0d2aa78d12d6fa7d22f71f927e3e7fb5a449db11860d44a8164b5640600000000000000099213c5577d5b99a1c3b9c7af47f1d378e8defdab2bb48150c4558068c72708a14168e0282632a3948645982f51c6afca5654f9de92fb4f4bfafe1ab4efd5b67b086130ef28adcbb4778842db3b72a44fa4d6d3f9c8951218c9dc4b0a13f4db79643586d10ee9887ab9388e2e74c6ace9e7e1f9660207d7ec22f447c28ffc08cb4bba410572b24b649e2563d843babe77f3919c064f33") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001900)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000081000000000000000000000008000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) r2 = socket(0x5, 0x4, 0x8) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001540)={0x0, 0x0}, &(0x7f0000001580)=0xc) r5 = getegid() getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000001cc0)={0x4, [0x9, 0x9, 0x1000, 0x9]}, &(0x7f0000001d00)=0xc) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000015c0)=0x0) r7 = syz_open_dev$mouse(&(0x7f0000001ec0)='/dev/input/mouse#\x00', 0x116, 0x240) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001f00)={&(0x7f0000001e80)='./file0\x00', r7}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001600)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000001700)=0xe8) symlinkat(&(0x7f0000001c00)='./file0\x00', r2, &(0x7f0000001c40)='./file0\x00') ioctl(r1, 0xfff, &(0x7f0000001d80)="f3f512ce00914de21abb0c46e42560ff55d1c3d141821eacdff325f12a8e3bdc9ba312a24b103ddcf256dcacf4ac6eb68f31610da12eb7a66749a3781017157d7a8d8b4d54eab2c6b99b84e782ab05d6724fd30a5af39f495e3f340621ff9e1ffe6bad088dc1589d09dfcad84430aaea300454912c44a3df12deecc0f8270934745994a7fa4d7cf27c5ea913163919d30d7993f18a0dc9003f1e895d0e748239a3c1394a6155c421c4a66f0d489c30e615fda7ab34090b613fe2d1fff026bc0aeaeb1fbcb3fb4302ed7d9c7671274f249f3c3d92c5edae2f070ca5c0") r9 = getgid() setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000019c0)=[@in6={0xa, 0x4e23, 0x7, @loopback, 0x6}, @in6={0xa, 0x4e21, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x100000000}], 0x38) openat$vsock(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/vsock\x00', 0x4040, 0x0) r10 = fcntl$getown(r0, 0x9) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000002, 0x10, r1, 0x0) syz_open_dev$ndb(&(0x7f0000001d40)='/dev/nbd#\x00', 0x0, 0x800) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000001940)={0x0}) recvfrom$x25(r12, &(0x7f0000001b00)=""/214, 0xd6, 0x100, &(0x7f0000000140)={0x9, @null=' \x00'}, 0x12) ioctl$DRM_IOCTL_LOCK(r11, 0x4008642a, &(0x7f0000001980)={r13, 0x2}) lstat(&(0x7f0000001740)='./file0\x00', &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x0}) r15 = getegid() sendmsg$unix(r0, &(0x7f00000018c0)={&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000014c0)=[{&(0x7f0000000280)="bba7c30c82dc34f3873a0cc45b34568fd574ee42b6c7d2b799e3e8c4faa922fdb9578feedc69fe0a2c246aa711defa358bca6b19c9fd36a0ae67a32e42768e6b4320f27a4c9d2c2c299853f052b131bf20e570dc1c65b9881174d6196c6210a580109e0e659866ea216435e1cc631deb5d1307fa586d61374f93c523a49c7e797dc3cddd1a94a7552f47b77b88978e4b5470d3e2ce489817ddda7a41be479e3646f10d508191f54cda30", 0xaa}, {&(0x7f0000000340)="ce6fa16b9b1d27b5ee26b024781d69493909a35c5af7ac391a89699325a934205b82d3dbe1aec240210345d11f4514c8020a449412fcef1606d5488bf48fd29cca123aaa6d41f2483eda37dc91d054b19c50ba77d2353641de975e4b28799d2f9f1d133ecde8acf74af14b835e333df515e7ed81451aa76f3155135ef7be56f456aef9b17e1c444231848732d604ea4226c647e4cb30268b6cb3b45a0ef16037f3d67f10b934a64d0fbbc2acfa87e79bcb4e8d27051312b9ffc703df1c5f91a9d0e5fb09cc982ad9d762db42490f16a59bf1268fe823b694e54ea6dd1554e0570d9fd287340f866e9cae", 0xea}, {&(0x7f0000000440)="a4cbc61ab45f2354fe1d2f693d237e0590e0a6c1a8e637a16d2513c2b6c9ed6fe714dbc2d38c37d5d062e1952acd33cf9b1e758c00b7b950acefed31ddcaf29b9da0948dc30265e050fcda054f1e675ecb9026a9ad020e00ee6449cd254c8568a3e4511a5b79067e7c0f68a5007896726023c05076b64895fe0e19188b5051b43fae7acd2f652d2e1c9df6cb6ef83683378253617761ad0264f1246f1db9711ed0430a93877010c1552bb159ccd76101e529b254e82a9c272ff49ad9aad2052ee63825689e9226d4c6b782820342fdb8bfe31bf25b23011548cada8bb661e6c7e05a3acbcd9f5299ba7494d8e28effacf021f59fd17df1fa02edb4ca86fd0d81449756e678e3f279ae5c249bc9d7e07e75f77cf8d9d54493301b83e9f24e98541efc43b66629f7d5b0d3be79add72e2251b478f9ae319f3fcf29cf43cd7960f9f33fbaf3067e7a862dc78395870c12aa16263822d9177339c31e45731c2cf8e19f89d8c5dff3f41c506ff53f19007c84f18eb2c0bbc61524a532fd8e5524f0b4dca95ccaf4d3113f423728a2821f75fae86009fda10a46dbf05dbffa1040187c9700855ea50c74a9f27bf8f9b7a8ae00f06c0d1dce31de52b49d6a8b90a968325596c5030f5ffdd25e70d23237f6fa7fcb16d7427bdc5f0f81bd0174cd86a130f5b5f802e0dd681cbcb8fc309f1559a41ed5b0e8c57f1e6fdefca6185f156504963347bbe7b54922218d59677fe00bffe17b8b2d65899d2720fb6cdf5d75d2686610c3cb8501da58a6e91a4aecd16bf8e6c8cc28b26ff58f008aab2155ef203d39f64f691f3e19c2f5640f1ee9aa8fb4d94a4d5ac58eb38a0d9b6432ddb291b676dc40ec82fc6c7156f28883979a3188c1454a80ab179561426432ab08076f6499cd51854df39be68686c8275c89f48bd351365d81ad23be2e2f69066c75ba139b7deecdff07eb96d8cb620e18779ee30cbeaa3261b40c620d3c481d463d1152e441866897d4b05b611c436a03271cc85516e73cba57f5fbe077895e8389aa3a2e46e407a7a80b7cad78896f6c030ad9b3491670648ddfcd0ee12719ea103329e829693759d540739a8f5673efc1164a2d49882fe683dd7917bc66043a840ff23807e42abf8c5d64dea27e6f215b2d924b82031fee871623228175d1acd3994b5221949ac80408b00494638eaf549c115f2f9620e711391bb0aa2f951bf72cd34c3031c53eb80861e631362d0abe3107aef3d51ac2c7909c8cd9db7ad22fef508504fcb1aaa3ed463500dddf823729c01811c6ffb6ec336a1056c995a1bc82e7cb8d443ddcfc345185b2c4f0137e1fd039d3a0c7e57340aeb51e3f7e3b11593d6de4838a2655d05dd1037b621dc3c202e09602422fadf9558e5fab998ef4dcf872b2e0dc0fcb96373309190b7df884939b38438512ee84fbd96c729aaf857fa2d938a7bb7cd837d14906dbdfc299102396f54737693827f411051be61d58f46ce1f34d978fe4563beaeaee9efa3504da08104a5f071f9cde22e0164bf6c28b23474484e3fc57a3d3db1fb114e70678b821020a591ae673e6adabadc2a315593244a6ea7dd631335aa90912ae7627f60e4ed85d964edcdf285d521194a2dd26971771be5a1b9c1f3686a724c84c3d27d518522dae209f33edd1e02132cea37563b6687be63dcfaf29ce1f74b34030715c3118e80acb8f8642ede9e4a2a3a53595ad7ac022c451e597a13ea1d6196d9a1a82b7652fa1bcb712c103ae84698c285ccf311b4f35ca937fdc568707228380af49a90f628a3389c4679d0f8680370b1f108905438dfd855cc73b7b8a124d688c60836a086f883a450e9224211cd3ebf4651c5ede0c19948911546f1e0e39214982c92f07ee85df36b373487128a56f3320ec17f208129b4a56ab4f834f009b3e6c5db5e871db25b2b502389c241b2f61e18a3a632e5a5a0e76031e9d84ba60867cccd6d101b3aa4b16100e4c3385192e1532021d23ac40becbdbc232efd06f72191b91ace132c042b7fb79d19ce68979f6adedf5b2294f3782346ed1876ab4d4924d8863f776eb60d3fdb590aa6c04be8c62de27c2d4f06d732416ee60d5ace488839482ea54ee72717db9730608bd1f1f7f680fd38e02ec139ee331bb934d416d9531d23c6935a4d5a6ec29c4a46a4b3d8ee6eb5ebe850f762c8d2205a00845f3b050eab7cdac3b7a07bab69b6b8bd570e40d915e40e60c4889f441e5dfd5cc8b675e8d8c056f22e9bdedfe13ea3193fc62a53fd384bd133fcc7fc56aac380b6b647229e18c0e75b6c945ff08cfa27577141932c1a9ad6eb890e2fb35353ec65628c2a49c564f6b1391e93cf578264179ca6366b557ee943505af08823760223e6092093cc08b639ee227b8f57bf4b6b79efe8d0485069c61690f61d7159eaa7c000607dc260ffce22ff712e7e09df97a7dca5f942bd19569e5ac2bb8a17b5296e9f92d03a2fd4ec085b9b9cc876cc45547ddb01f0a8b7419964505b12dded6724c2d89af067bd4cd34d1b1d530f604a9e97c6fa1eb9204c349592d5a35009c642598b27ae50072f95bce31c83b36b6bfb4d3143c9c654d791cddd42435860e8dd614af4d1552a710f70d5ece0d3ba5fea7b6945820844b7970c50f8193997b3c0bc52f735d4924b04f5300fd76cc489470a8ff2766e9d6b13253584d715b03f9e21d88bbfbeebc00dcb2fece202aa4e2b507cebe30e061c083b0f87516c2a80ba9d252eb958ea2087d77d7adf26a810e56529a1bd80ae20fee6676b991b960146c876f692938bb9e9a05347c07768035b66434623734850001cc7ccc47671ac5514ecc123e76e7a57731dfb1d1d0918598071dd94460c82a82b7a8893bfa86dfe6f3bfe2df4c43709367e2ec3aa7d5835f42e0b2ff3efe083b06591c89058851324c74e68d4b650278da039a5ef38dff424d5b866b537497104a2f06741fbf395436bd692a0ed6ca3290e3dde255a58df6e6e83d50026646f328c9f11b4ea83b2f79f2fd8ec45af1659989b4ebdfd60923f723eef86cc0513e7258a005bbc0f9e45b5fcdd3a263dd6be9efc3d847cce707737bc8a1083745f41e97dda4ecb50b414393d42d52c91fae81c3e2a7aabe0bb0e8a5d6a8a9ce6f8743e184e6fdd6e5808034272a4ec1ab55ee6f455b0730752d9e48181697f14c81953a69bbcdcda8f75a018bb2a34817ea3dc2f4f389e1e429b7042401d3abed5480b31711f30ef117a244de65a7ffab513bad247ef1b125de74f745e87baeac7ff43ff78ae523d68a671f07c2fc202e004eed3aba827f051c91e19fb722b54aaea492a415b18977f87050fd83ba13f950c916b673387506170556c7f49f286c10384111bbb9c7f2bb7f95eeb924cf9a17a5fdfae71ff792b79e1bde8f9287a34b93f3bfb58843fca1d57209ee6b661b1f6f3a93d7bc7b74ccf997fb32201c80bb400d2449e6d4a2fcb6c1911b48182e5353eca5194aea5cc2d59cb35979cc3ae4be03567b22e7cad0df5c031fcd591dc2874057512e91478d80a79b1000fff3fead3be0a05e011292b55a4407d297cdfe7f645b935fb082b0c518316b1363cbc7e2b3d9b79b948ab67ba29ab2a3db29642c2ea68292026544b2be1ce847b7ed11c7f43fddde051dad4ddd207da41a48b2b470466e0a1ad93abec9563c48fc22fb7c1b34a2d448d154e8a320169fc82d7c8d556474a636227e164a955e4ce496b1f85351b1fa185bfad7e83614380fbbd4f2257cb8913d27349b32952cb82d0ba071c187ff707029df2b84a82af595007e4e2d51b242878649fd5cde5c630276654f76afb297f6d0ab8963c20909eb4f109e1def7aee74cb88e4f41193818e0b571c4407f3c1851ad5b5d32a77b36b32d36d72ef35522c0ac2f4cd5570e01e988f1b284613112876a2ed4d7a3d74dd6bdcee7014286d4608860e7efb4c3e188cec965d0948496bf1c6439a46843533114d8bc45a8376a644735c524b438112636c45b014a3587883e578d9e86baaf20cdb800d4f460e5432bcf566f4b86ef09bdeed1e2b143bb311343c4a7bf9845fe660bd710ebd83b97188590ca5f3c28c1cad30a4675783974ec4c2f4af3d5df735d15f1cd143621ff6d0f21dd1b2c2e48fb013eab061db67c78e54a2f4914de62d598dab7b0a7f758cbbc0cb3ccbe04043a510f342023cb980f69afae098705d523f7c06e9e8279e0dd5015158613176fb8851b0d9a942e02f4a1ed3ae36631ca6b054172b27eb543db9f09463bdff57b6c5c72c2877794fcee035fdbcc0d6fb3e08caaf00028f86f46f3ae8809b59f498abea13bafbfc0f42bf479f9a44646c6bdfd93c765333a62ec762f7f3bf516f17cf50e1407c6b417724d05f72189d9ed5ebac9d0143349f05038c13e9e96a9df1b91761aeae4721e7e817396ec74f3cef1b4348b28bc5be63d74d6eb68f5d5026c8139728a9510e6fed2bf4bf48cfebf048dcd627f95ae8dc0082dfddf6f44a08fdc69ffab04980cd44ad139a75cc0b9643205a59ba7cb5a28657aade3c8e70e1aa74c24e505250ca755ee1e1db930dbcd1fb7468e9395e3796402f582c7d060f4b93cdb7e4008398e5bd37659070ed4aeeadcd686ae66915ca7db3ff66636ebd1872dc169c971533693d99be585200d505f219df6afeff99cb3c145a20c34c618d7e796297f85f317ed3fcf28986a80437c9da8da86fc89827b458331cd270c38823e02f38d94d7be39a8d6fa62a834385423f1792a975046bf225d05237352ef013f2b1136baa42f35107515dc6d67adf2a2c891bf450a8f5671286acdfdc2986794c90fbf6b684a77193f2ebc26f9db28d6d1a9f509682cc3f7637405b325836f9f0797f71ddce54da6b4a87e90026890b16e509057c3dc2aba2cb096568ea83614c6f946e8eeaded0d3a4639b74d09f1b827fd109c4d9248204d5a467b0bbed7662ccec818723fa8bf06cb523b3d76f6864111904f7548a028ee92774ff9d5ed95d2f44d1adf8696d71444d4c91c84bc3eee6961224d0f4347a659e9896a5e5f8351c1c247ef633c51cacca7e168cdd9368618a35063532d02b5d24ff813056e7a283cf899e12b6fa628f9638792118a04f081b8d16076c77fd4b6efde1480ab26ab791e177563969afe6a64d753df99f14f44099601a7cdbd1a2aa525f8165f2e427862a3710ef950157eb194bbc02c2f09fc4a1247de79f6453435ad93eee93cdea85e0c7bb522cb18fd5df301d04d3fb33ae1f77e15a68c454b525daba3debb9c42d2bec6554fc19691b4654842dcc13d73452d266384c866201b3c23de436442cd1e079b10518414ca48f58f897c49d5c26d55d88a6d968e661002cb19d0e63155b99d13b029e9c04b6330b42beb83218acfa73334f144caed2be2e3c3c0d123f39e7dc992fd51655f9ac5567a15a611e557a5c1537631e492ad08d611fab4b4c620eceebf36935bbcd114970de24500c69399f699069fac9f205f69194f5b6eb9f30c07f450636569d6fd2e63a2491d5b5917a42924dc3cfa9f2af03bc7201abeda0cadfed79cd5a285356974a3f808c974ec35fc448c91d2a5bddd4dfe3f12978111d0818750e0b7ec69d5f812dab6093fbe533ad78fc04c60a0e2031f7840e9f58616b3262b9221b8ba0bae46a75d5b97ed3e2cc6782c549f76fdafd795d0fcdead77ad7cc3f7225705174cb5151e47d686246f17c4f82a8d7e78ef2873d1cce04a3b2631124f0cf6127b6bcb3f36c1ad7d693e6a469a6691f1d8fa40a28c6873ae4520423b8af4a478ecd57bf8de348fdc0", 0x1000}, {&(0x7f0000000000)="aababda96743de03264d9fdd9e56a027cfd36ddda8fcca84bc6450596259ed82535d30cdaea7493b5394de173109d701ae4816", 0x33}, {&(0x7f0000001440)="5582db4dfdc401b5b4bf6bd5ef3414b8df7040adf93487ae07affa8e4dc07e8c9724d48be1f3d6fdaf19d7f159aa84ad7eedc34f163661795927d76056a37df674", 0x41}, {&(0x7f0000000100)="b68f198a7f16c07d085f0fa8", 0xc}], 0x6, &(0x7f0000001800)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x20, 0x1, 0x1, [r1, r2, r2]}, @cred={0x20, 0x1, 0x2, r6, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r14, r15}, @rights={0x28, 0x1, 0x1, [r2, r1, r0, r1, r1, r0]}], 0xa8, 0x90}, 0x44051) prctl$PR_SVE_GET_VL(0x33, 0xb64a) [ 1789.868322][T22576] binder: 22570:22576 got transaction with invalid offset (0, min 0 max 0) or object. 02:04:54 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x800000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:54 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e1f, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1789.939553][T22576] binder: 22570:22576 ioctl fff 20001d80 returned -22 [ 1789.950118][T22576] binder: 22570:22576 got transaction with invalid offset (0, min 0 max 0) or object. [ 1789.971798][T22585] binder: 22570:22585 ioctl fff 20001d80 returned -22 02:04:54 executing program 0: setxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.ima\x00', &(0x7f0000000180)=@md5={0x1, "db385e2907b93d61efa1cf26d3eb1503"}, 0x11, 0x2) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x16080, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000003fbd01fd5e74e48d542cd7d4bb005d14e48a775190b45446bca6573e6fc11778c0e03bca52396cd7f3404ced6482f8191770f4c7e6bc60e793c06a5e0700000016647c9d"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:54 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:54 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) r1 = dup(r0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000180)={0x200, 0x10001, 0x4c00aa0}) ioctl$CAPI_GET_MANUFACTURER(r1, 0xc0044306, &(0x7f0000000080)=0x7) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000000000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) recvfrom$unix(r0, &(0x7f00000000c0)=""/37, 0x25, 0x10000, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) 02:04:55 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$setlease(r0, 0x400, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x5782000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:55 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x80, 0x0) sendto$unix(r1, &(0x7f00000012c0)="59bee0ae223a73dbe2f46f618b2888342ce9a857fcc8135f597bc03155b67ed6e5a9c70a9c81483e26c64c43c314ce62e58f045749e4c35b6df4fa2bc99b6391788c06637f19d2af952cf74daad91d1785645d89923357db0f2a4b8abb56a9c2d60bfd11c4c80ee881ab99d2bce5d6412b8b37c5546bfaaf3f230f36e126cd7b9678fed03d457f7ff94aeb7e947ea880f279fec31299022ce96bf9eb7cb130c300d84744c912b78e4d430736eba1a33c68d461dacdef0e390f2840768801589d21cf4aa061903484396c6122", 0xcc, 0x0, 0x0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8100, 0x0) sendto(r2, &(0x7f00000002c0)="5bb370f746ed8c441fd89ece9a6960c5a74e663fb6c26cac359e2b733b8e1aa299ffa4461e89e6180cc398b6214070555378566eff599a131a97642c91256c0eabcc3c2de532ee4ec4c3cb3168c6747c2f4df3dd448a42ec9d2596fba70cb007bad6510abb7ca9a99f64f863363884cd8291638f3b8976df659e3ff826b2d52706978a3e4135b65405cfd2da7223a421fc8411ff4e9de45a47fa2bb627041c8eb53de8323fdd44196ff21ddff22c7934a8ac73cc2db33706d7b3a4cca94cc5ca547f65d2512b3c0e31cf833797f5f2e4a365d507ce437de5550da59b81249d8070a88ebe4f52aa6dbb2d3e07416f0c876e8580c23ffc605d3594b8c108144ea1f205c7651836536e4cf0e8f3b8eb7adbef853dce8a393a24b57931a838fb331f2c348b3bc124dedcc8a56212dc0fe009beb7adea1ed984078e304df8bdf53a4591e11660faeee09c5c3a955f0eba8243589352ed95954e7a302f4466e2b16d58d6e0acc9cc9ec0c0cf6a4a57193a97a42c43424621756bf8eed957da32f57d104f5ae1a50cc1ddcb1e8587515692b3b648e6521ec2165310f40a93f9c3b98645ba9722d07fcfeac2eb4a2262af4592d1924f28f520fcd8f4bb2322c1269bb169194269d8e348927949758dbedd475c8ea456a418c95051c58544074697cc6febc4d2c18c5061d5d999a3ac7ffc7a6d6b26a9e9fac39287b12135c2d470902e02aac51816bb2d57df0cf84e3bc8b63030284172e49f9a478672b30d30b052842e3884335ca24a40ea1583f04036a64816f886c49f033f0804601739268f1e6308c233b71b06d94a0b2a9a005e50bf3df51b464ab2d197baaf31c4abbcda8b1edef6c88b99db22da6e52cffedecf427715a73d1f638c394bf55ffbdd86e633dd31a3d18a60cf088d77bb868f781ba24ad088a5c8e0ffa6d4f86283b21876c2a05f8384133850b16417d4bf3bfcc03836b693ad74665ac2bb87e78245ca6f5f4c4ca7e45ae372caa67759b48758f9ab6833fb7dd2a5615a28f817896db471b36f63252f94e54d80a45694581f796a3cee6b70d6d1102934bc1dd4c459d384190923a80fdb29d807acf6a43f14b500eac4d7af1e9145c9f3342f93b1c5f7888e8084b08e13c310dba97855f6eba525a33728930d8b029f203095f8ba1f7265d427b8bf864414f1adadc4329e1e7a969ca6d28d42f5f6186637809fe25b09739f602ffae2ab62e8250606a01ab763a754660d63339616d216468fe8837737d90361a3493279e1886a15149bc10dba95c63d9ce950bba839540f1ba8097f4d6e56e8dbb29f06c3cfdf433032f7e3c0d2f906f9f3d672a9ce9f2b944718251ead2e900d963f7741051b838bf132da5f0407037990e92a7c59ddc29451b08fb94e76bbb88edc22de663f25467d9fdac4462469b749784e56fca09098612852e332f181a80392a651df14f7a867f627091816ea9c73d105fc26b1fc681ac6003b50b154de1a18f6758e5c6c7ea52070a33fe41c25db54a6dd1462a12fbd5d3d8271948efcfa5599dc6475f9c939a4391becd3404e62a98108a7795fcff9f5738f0bc49f5197a559b1246f464379ed1d24bfa3d089706dc74bfd2fab78baae4a67b62c829f91978f396113015b13d8c3aedd211a5a290dd27c20906f752bd4e89dd8f8cfffcfa16cc182845f39b6a868d00cac4b0321fc51d75a8a8f75f4ddb3bd4cf1d7fcc17e6f4ecba80e7d6446f7f5602543374ab6a3037b5011e287cfb8c093e138a74a1a49fa84e6557e1ae129aa5c9847445d56bd21853a3788ca30b75087e783ed3c5db19e0760b865579d24131b68a7155678f901149b9bdf2aadc1976865639180ceb577c6cc29551ca21ffae6b9e54f5becbd58cfb755840712d4e156ae484155703af45db9b83687dcd6a7be6000fed2cc65c3112092cd8e9377bd34f6f6e95d3ed259105370030e0eaa7379d09c4e6f28ea23a4589fd9f53ee5a6b2402880178430d826a7a8016fa5536f0aee5416ac1d9a2f5991a9f915324b288304dad9e16e22c42acd55a114494f7e397fca5c42c5988528b904ff1c11b1dc6f6ddb45e6cd5f39fc60912f8fab415b12b3ff3b30589541641238f601db7dd1f8c2c98c6ac4972b6d9064aca494894d87d07e22f705c3834e9402fe889a2e97014474f9e363198d01c96b6a80adf08a4a8de076c3ae077f3e33f5007e7dbbd241ac753d55cdbafe1c97268d11050cc59e6cdff37baa4a0e5589607a05ac5c6d71a171732c7ecb2397f5fed323e2d71b06c06691baa3c63695ee521a5fdac0089840090490781e45d708c9fac4b69c90d41f926aba633af80a0cbb8aca0f49fb25cdaeb766669e797f11d744fa65e1258ace6504d5be62453ac8d6655eac28c50399ea4f6c46fafea4525ae29d4f4e38fcc3533c836277c93d8a9c4f9687d85a43d9d061019c76bcf46ffd7ded3a3671803ff74cb3ae185c69a7d94bddd913f887955290d3c091f754666d4bcfc58a5af2121cf39a3d40b8bcdc0690808c32624556d04dc364c74507adceb8a6f16a3b434c4895f6353b7417913f5f47346a3d7c228aa2f532fdd3274cb15a4676721cf784e3c0f3f8d0354f2d79ae5dc9c59fa7d7132a0ec5a4cff5ab077b5c2f57b806b8e5cfcaea9f515ece7dc803db335e028aada2ef6b42ce974e54aab883eddb713f555f7c897932e073e8f4a7864d05f637b1123870db00c53362d82de90930b50b1d09a324bf6d30d595de57ce4638d3d210bb740fb3c0fef3fe5e423454e6250498bc1bd2090b1f3720e975150d832ef3acb07a55bc871cae8eab5e41fb522bdf27408aecbf1b159448f2bcd3e0e9b1a8c00fd1e4863f0311a849f130481ee7dbacffae6df0ea88fd5f837e1aee0d5fcdecfe61bc016b86117e1bdad00b6be210b313125be9f0fe0badeaca58cddaa91f922e63556e37d4a8c0ce0b898f7df07b5dbafa8b7461e55f43b235c3476bdfc0114e848b243ec5b4d91e42e7174d7026f90b30d148f263f7a990158bc658fc7ab2c933e377a11ac938fe75f4667dece3017151f6eb80028d4ed22774562e87e77daa2d378896c90701f9f9b44ceb71d52b2cbc837e308925ae688489567bd1277f49876f4856622fa8b8c02eea4df83a64cb5e3b4648ae510d5e38023ded272e0828353a18e114e831e59f11a6e1a2c05d6614b54ec694d83958bba73c211fd9968ea628663f2cecd843579df86bb717ad95ce3429c007da7606f61af54cb8d12a1945a86b943de3e0fdd3cc52ead0b20a6f60d9863ff5236015a2b22b4e44b271b4af8918de5ffb899a2500ca4d1aa16c45dc7bb1d8dfadf49da81f821612430c307b8b82c9c753ab1277c01e397efcb3ac8bc543e01bcc445aab744a5da44073bd6ff7164fa032b0508180c70aa5450fa8fe6e588e3259298032e031e29f7685f7a34eca12cdb3e795499a904eb36ba871a3fd6cd8c343b55ec3be54f3c385003af1615274dc91a00b97db415c34b7f6493327c0a625e0f7ab94f48decd7a6dc5437a009de9702fbc5e225ddaf2d7c8e85b2af6cf955fcdcd86bec169c1953d396d7efb613faf7b16641c5d7f22c3de33ab365969614c1cb30129ed6cc3ec8d321a581f428b30638b93a4a011a51508e46eb4fb38bcb5ecc5512e04f81dd7d6384c51c61a2ed83cfbe569e05562d6cf2fca16ea42e72a8ee456d05e97bf6dab03e2962bbb5e987f6e6cef13d69f1be42ba9e6b750bc727d6292c65cd7e076afa15698d30c9f199e71e2bb6e02c6d5754861859e8155b4e1c7aa84e5b702a377372fe6da62c36f328340ac15d225dfd307f8217b0af7210651d5990056f0fc4b92dfcc73c328c9d61f845da0cc419bc90300b3a54b66c8521b6965e343ed7e6802a2daac9db705ede6d9ffa7179d0d8172e4b22210b6be5d5223a38546596aa27bbbc3b45360056f5d58db7d888724580901a55203f39a95f36ef9840a919ab876aaafbbcf9c6bc7a8c5efcebce06a393315ceccaa279c06471bb783728495979c3810431c774fd436c66b9c2f2413be4783a14e3f57b27db8a6693bf242fc4fa992507add11b4beb46e36671a193a3707f725322c390608eec00c33ef53a1cd8876309ffb3eea725aaf57f4f9e3111da5aefefcd25ed52ae89d1560425dedf0b031031374710e4e8427b729b7511967d50eeb04585da2b90d1538dd87065692dab0a05e178021d22dddd78ca836cc37045f23fa757fed1f70d6c9037b0058d790028228af4e81cd6a2365e68d983e68f7e988539fc3599df114dd1dd10ef55cfbb7d1535eebf537b1ebcca8607d03f1bcab928130979b6b5b994e1ab9b0d727f72f16ccafcd1d9b5f61230f574600ff4ba926aa2e1d9bd680f80ece9c275e3f7cad266ca61a574864697992765a5d8de2b73eefd86c451d5af597d55dc4615d1bb67f028deed2c8d1d4f3e85ec6212feaeffbb9ec293e67bfde4b932af6966c41501667bd6c9c919c93702de8f45c963c3d71795cb11bbfc378a45012d1b95969f775092bba9bc110528d6ac3191d1dbad71b45faaf0ff2a564865ee9150c2d5a7b3a9662f0dd1115fc291f6c92fa724cc178010a8a0d9474f42abf7d1ee66d8d9d3230999f1e5ef22c34dbca508591492591037e64205977ef191ce9311f7598dec3fb16fef5eceead3abf33a0e20d452d22dc4a7ff2470d4afc23a95cb8a6c1791f65ba0a6dbaefb93a1a5c5589da38bac45223681f28f4c55466fcc5be13a22655b461240b82a0809f165b99b8c1142ecf37236477b97c07febffbd0fcd939b67b924feddb92762673105c821c6a5eb11873061884c627cb590e89e97e97da8a9bbb4647e0d73dafad0883853fd982001cb09f5972e3bd5416f2a27e8be8de4c808df09c8552763f04d384368000dd0b45a460de285467898e8fbdcf68c6a01b41f857af6db450dbcb9078234c04247fad66cf68f9bbe1222018631e6072f87d51634fe4fc5833dcf924a28e3c8c1c8c9a049f7eca06fc179c7729b84145c24c3915848cb2b4712f18c07e02a8f47483d31c48c9a802f2277ab1b59a43cccdf57b4a5c7c522014e4d7945a6583cd05f57394d59719ee81b8bcb52ab53d29dcbad373a0a525795c6aabe20f2b3ea60d3a79e577cac1fca78d9e602550e6a478e5821e23189c29a538b06f2d0fd2b984dc37bc29eb49272bb4413cd123ba0399658db83013b3d4374adaa0549ae8ca40f134c9d8e21e71df4c6e393fd1c4ac76a87cb2daf691e75d26f68d4d000c7ea00d2c58ea35a9e0580e146297e5839bb75c0dc39333a6fa296b71ed45deff43a6abd52e1186171d92ac7ef6971e8f9d543ae76ac36c0a964f5140090ccfa4acb069e6be245b94cfc0e82d0bf66be796838185b5bf2b3fda5979825f9046c60c1ced8233b4847f5828f78e01e57a3ff36faf2a361d15dacdff2b36d754a00c808e360675c45a10c7244fa444b330d3116a38361d23f3e61c1ac6947705a046764f7dce41d7d10e9d68658795131ea0c784c12590e47da7a099d23cd211076e3bc1abc1dc9e256fa974915c69bbe5a69432a431e1b687a638d065de9d825b0de2be6dc7b1105f4cb8998bb1c77602ae8af0a6b5a5edd474cef27e52c9c2e8a2d8db45ef902742b00dff4bd6f26e49e946252b9f7c36b5d81016cb2e60f4a45fd25ccfcf03dc17f9deb57279fbc6c476c9de42571b66026d54bd3fa4f27bc6e801ad70eb86b4365fb7fa6653e28798b872e930e7e75ab9be1afed5bbb142766cb4a1c935e683d77fa763e809302ef90d76175", 0x1000, 0x1, 0x0, 0x0) fadvise64(r2, 0x0, 0x1, 0x4) ioctl$KVM_GET_EMULATED_CPUID(r2, 0xc008ae09, &(0x7f00000000c0)=""/195) sendmsg(r2, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000000040)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:55 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3f00000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000427400000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:04:55 executing program 4: r0 = dup(0xffffffffffffff9c) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) r1 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) 02:04:55 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000140)={0x100}, 0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x282000, 0x0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000002c0)={0x8, 0x0, [{0xd, 0x4, 0x7, 0x3, 0x41fc, 0xbe, 0x1}, {0xc0000007, 0x0, 0x2, 0x0, 0x3, 0xe755, 0x80}, {0xd, 0x5, 0x3, 0x4, 0xb9, 0xffffffffffffc743, 0x100}, {0x0, 0x9, 0x4, 0xc614, 0xffffffffffffffff, 0xf73, 0x17d1}, {0x0, 0xffffffff00000001, 0x2, 0xfffffffffffffeff, 0x9, 0x3ff, 0x7}, {0x80000009, 0x0, 0x2, 0x4, 0x2c, 0x0, 0x3}, {0x80000007, 0x1, 0x2, 0x3e079019, 0x6, 0x9, 0x8}, {0x8000000d, 0x9, 0x3, 0x9, 0x2, 0x100, 0x3f}]}) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='wlan0.\x00', 0x7, 0x1) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1791.003119][T22735] binder_alloc: 13398: binder_alloc_buf size 32723665132978176 failed, no address space [ 1791.022386][T22735] binder_alloc: allocated: 272 (num: 22 largest: 32), free: 12016 (num: 1 largest: 12016) [ 1791.032931][T22735] binder_transaction: 10 callbacks suppressed [ 1791.032949][T22735] binder: 22730:22735 transaction failed 29201/-28, size 67108864-32723665065869312 line 3147 02:04:55 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='dummy0\x00') ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1791.206656][T22746] binder: 22744:22746 transaction failed 29201/-22, size 0-4 line 3201 [ 1791.247264][T22747] binder: 22744:22747 transaction failed 29201/-22, size 0-4 line 3201 02:04:56 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0xffffffffffffff80) r1 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @remote}, &(0x7f0000000140)=0xc) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x7c, 0x0) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0x3, r2, 0x7, r3}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2, 0x0) ioctl$BLKRRPART(r4, 0x125f, 0x0) ioctl$VIDIOC_G_AUDIO(r4, 0x80345621, &(0x7f0000000040)) 02:04:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x8060000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x100, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000e0100000000"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1791.764268][ C0] net_ratelimit: 24 callbacks suppressed [ 1791.764275][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1791.775923][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1791.798172][T22754] Unknown ioctl 44801 [ 1791.819534][T22754] binder: 22752:22754 transaction failed 29201/-22, size 0-4 line 3201 [ 1791.837718][T22764] Unknown ioctl 44801 02:04:56 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x6400000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x402000, 0x0) ioctl$VIDIOC_QUERYSTD(r1, 0x8008563f, &(0x7f0000000100)=0x0) ioctl$VIDIOC_S_STD(r2, 0x40085618, &(0x7f0000000180)=r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, 0x8) 02:04:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x28000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1792.075356][T22871] binder: 22867:22871 ioctl 8008563f 20000100 returned -22 [ 1792.095651][T22871] binder_transaction: 7 callbacks suppressed [ 1792.095662][T22871] binder: 22867:22871 got transaction with invalid offsets size, 4 02:04:56 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@v1={0x2, "af8cd5523274e5b684ba24db33e0"}, 0xf, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40002, 0x0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000100)) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x3, 0x4) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1792.120161][T22871] binder: 22867:22871 transaction failed 29201/-22, size 0-4 line 3201 [ 1792.150050][T22877] binder: 22867:22877 ioctl 8008563f 20000100 returned -22 02:04:56 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x29000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1792.199255][T22882] binder: 22867:22882 got transaction with invalid offsets size, 4 [ 1792.262273][T30760] binder_release_work: 10 callbacks suppressed [ 1792.262281][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1792.277004][T22882] binder: 22867:22882 transaction failed 29201/-22, size 0-4 line 3201 [ 1792.321698][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:04:57 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:57 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$TIOCNOTTY(r1, 0x5422) 02:04:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2b000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x408000, 0x0) openat$cgroup_subtree(r1, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) accept4$netrom(r1, &(0x7f0000000200)={{0x3, @netrom}, [@netrom, @rose, @bcast, @rose, @rose, @bcast, @bcast]}, &(0x7f0000000280)=0x48, 0x800) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r3, r4, 0x0, 0x50000000000443) write$binfmt_misc(r3, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1792.685654][T22892] binder: 22891:22892 got transaction with invalid offsets size, 4 [ 1792.693625][T22892] binder: 22891:22892 transaction failed 29201/-22, size 0-4 line 3201 [ 1792.725644][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1792.804238][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1792.810053][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1792.815974][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1792.821754][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:04:57 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xe106000000000000}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000100)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:57 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x2, 0x58f880) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000200), 0x4) sendto$llc(r1, &(0x7f00000000c0)="bbe0b2cc0935c1e5ef4f322bb2d863b136acca62f0a4938caa2c84d191395f0268d4bfa55601039fc558d4d4344dd9b878b87277b4afe3859b6275e6e6836fca9e7512dce15519b27a94a2ebfa877562b2834406eb545f18fa3b5aaebd1c156c1781c1685cb5bfdb9c74ddb056b39320a608d095a991b98ead97a77e61ad48b6b86894dd61a938e58044c40f7ea2a07193252ac1e53819b6d2616eff5144d4f4143120e8ee72cad76319c23f6fccd87aad4e4e40ddfd400b0b8001a30e25aabc64a4ae69bacfce11e1d2ecd024ea", 0xce, 0x547fd023e6090950, &(0x7f0000000040)={0x1a, 0x8, 0x80000001, 0x623, 0x9, 0x15cd, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:57 executing program 4: r0 = socket$inet(0x2, 0x0, 0x86) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000000), &(0x7f0000000140)) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5, 0x0, 0x10000, 0x400}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000100)={r2, 0x5}) [ 1792.984399][T23002] binder: 23001:23002 got transaction with invalid offsets size, 4 [ 1793.024375][T23002] binder: 23001:23002 transaction failed 29201/-22, size 0-4 line 3201 02:04:57 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x2f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1793.089384][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1793.124233][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1793.130137][ C1] protocol 88fb is buggy, dev hsr_slave_1 02:04:57 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x100002, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) write$uinput_user_dev(r0, &(0x7f0000000d00)={'syz0\x00'}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1793.135989][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1793.141744][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1793.190845][T23021] input: syz0 as /devices/virtual/input/input17 [ 1793.227063][T23021] binder: 23020:23021 got transaction with invalid offsets size, 4 [ 1793.255044][T23021] binder: 23020:23021 transaction failed 29201/-22, size 0-4 line 3201 [ 1793.305992][T23104] input: syz0 as /devices/virtual/input/input18 [ 1793.328426][T23021] binder: 23020:23021 got transaction with invalid offsets size, 4 [ 1793.349669][T23021] binder: 23020:23021 transaction failed 29201/-22, size 0-4 line 3201 02:04:58 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x35782000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:58 executing program 4: r0 = socket$inet(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4620, @multicast2}, 0xffffffffffffff64) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x3c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={r0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1793.462825][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1793.532330][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:58 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x4}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:58 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000000)=0x84) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x84000004}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)={0x12c, r3, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x32}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x2a}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x401}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vxcan1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x80000001}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_hsr\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x40}, 0x4) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={r1, 0x1}, 0xfffffffffffffd86) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'bond_slave_1\x00', 0x0}) bind$bt_hci(r2, &(0x7f0000000480)={0x1f, r4, 0x1}, 0xc) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x80400, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000200)={0x0, @reserved}) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000180)={0x2, 0xfff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1793.926650][T23144] binder: 23143:23144 got transaction with invalid offsets size, 4 02:04:58 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9b060000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x43050000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1793.987884][T23155] binder: 23143:23155 got transaction with invalid offsets size, 4 [ 1794.025388][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r1, r2, 0x0, 0x50000000000443) write$binfmt_misc(r1, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1794.032875][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:58 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:58 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1794.155709][T23232] binder: 23229:23232 got transaction with invalid offsets size, 4 [ 1794.190825][T23263] binder: 23229:23263 got transaction with invalid offsets size, 4 02:04:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000)="dbe4f8dc2785c4af75f9a06ae73c90ffe13bd49fdaaa7b43da5e486a3d848fa268cc9746bc9e3d245574546ad2cd503ef07fac555e68aceb8056583bdf29e510347f9e0febbbf6a994aba48eb37921299b71860ccacb01a36d9e18", 0x5b, r0}, 0x68) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/snapshot\x00', 0x82040, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:04:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r1, r2, 0x0, 0x50000000000443) write$binfmt_misc(r1, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1794.245335][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1794.251557][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:04:59 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x40000, 0x0) fanotify_mark(r1, 0x0, 0x8000002, r2, &(0x7f0000000180)='./file0\x00') ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rfkill\x00', 0x200002a080, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000039000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0900080000190000"]], 0x0, 0x0, &(0x7f0000000300)}) 02:04:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x800e0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:59 executing program 4: r0 = socket$inet(0x2, 0x20100000007fffc, 0x403) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r1, 0xc0485630, &(0x7f00000000c0)={0x20, "16f7bd500ff9ff174b3b36825e2a7ca0011e6701c3ebb9f5187c5d6fbe584631", 0x3, 0x7b2ebb01, 0x9, 0x3140004, 0x8}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) socket$inet(0x2, 0x1, 0x1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x23d) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) vmsplice(r1, &(0x7f00000004c0)=[{&(0x7f00000002c0)="9b9fa399dfb028ee507e020413cc8689b0f7d114b80c890a87b345a47059fdc6c570846d4a9bf26c6cca737d04f0edcc41dc10b339bd8e60458f822fed6ff17406f14060ac7691922d4094aca6060d97c8678c11c875a0f14904662c6d090b66a61ae34a9b13e9a5177936a40c22e9eed0ca35c507a118106a408d846e137bc384025b32d1114602f2cc311baf09fd0ad8df80e8981fa82370bd59dfc7aba043425828def541707dde0e70433c5532440d891ffcddaf6041a2022db096e7c3eff141aae59060f74ed99db816b9b49f8a24b8f47c1be7e96c156f495fc273d0823709a7fc27ad7c46b147ae2b267704bdcff474", 0xf3}, {&(0x7f00000003c0)="0af3c824ed33a6f9802f98ac0ccddf50c8adef18fbe42e0a0dc65ed923323b477dc0340c1c3f286840dbf483c42252a98c355fe51cf190f0b05601a49a697d7f1b917b57856a27989c925bf45632dcd52f156d0f5a83d25b0d092f21de1ca14920f87bd14f1a17a15debdb8bff80db9a79ac14735d2fc04a35753d8573668035c99da84ad273c4bdd59670013bbe09e326dd06a7319951f04837fe14fbcd2b0aabe1f42eeafa114f2487e7711f3a37ee19b4a5dc53ec313344490644b0fedd9c88c9438513dd85767fc6555f396b16b314cb74b2d9a8e23cbc2fac967fddd28f", 0xe0}, {&(0x7f0000000040)="b4b3b0d409c399893c0430b39d4613e9b57068c6c436bc3c2d212459966bd48de249d01bfa0cd371ca", 0x29}, {&(0x7f0000000140)="b348592bb24f5a09c65881e20046f90947dc643c814f151123ed8c096855a26f9ae430b6fdb394d184f59aeef6f420685d94032649", 0x35}, {&(0x7f0000000180)="761a3636075e9f8f786b18f9eb4e09f1b7c7616298d5c5bfb5256d66d6fa8a33504fa9a9d2babeccc937", 0x2a}, {&(0x7f0000000200)="d562e69e2a0ee2aca0b88d65a501605a18cd89be10fae6c1f2be0173a235671cc8d663b28a177381b4757c97446b6c89d71f0842644f283f75a743bc9dd92289da90011ee6edef7483e8afd8df62b90b09c0f63d99ea64ea8e4b11c741a0427a2920006e6450918a24400c2ec37e0c013647bc5d00403108c850ef1892", 0x7d}], 0x6, 0x9) 02:04:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r1, r2, 0x0, 0x50000000000443) write$binfmt_misc(r1, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:04:59 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:04:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x80350000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:04:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000001, &(0x7f0000000140)="0a0300000000000000a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000004c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xd4, 0x0, &(0x7f00000003c0)=[@request_death={0x400c630e, 0x2, 0x1}, @free_buffer={0x40086303, r2}, @release={0x40046306, 0x2}, @clear_death={0x400c630f, 0x2, 0x3}, @reply_sg={0x40486312, {{0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000100)=[0x0]}, 0x9}}, @transaction={0x40406300, {0x1, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x38, &(0x7f0000000180), &(0x7f0000000380)=[0x78, 0x68, 0x30, 0x18, 0x0, 0x40, 0x78]}}, @request_death={0x400c630e, 0x4}], 0x86, 0x0, &(0x7f00000002c0)="3490e3fe922dc80de114daf78404165921b3c61be974654f912bd53e1e7e98accae1c7160c44faeaefa600c462ddda9ceb53e34005a3ff70875afff51711e4dc6f80d39e751c3581b17ca530d0bced59129afcb7c12dbebb47c71fa61b67d3293f6c20b404541f4309dea0db963e9aa6edef371cd931b70bbcbe64b5828d5e3c1bb7dcc58bab"}) 02:04:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1795.030850][T23304] binder: 23300:23304 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 02:04:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1795.074547][T23304] binder: 23300:23304 BC_FREE_BUFFER u0000000000000000 no match 02:04:59 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0xd6}, &(0x7f0000000000)=0x90) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="010006000500008080008000440fff0705e77c4ba9be3a14129f802b6f3d1d051e8ded87f06e0044e50ccab3904aabadb17bc70ca97b164c9471075b16f064b419aa72a3f2315f09c179eef45e822984f4d5173bca0b2bb3d770d7500f81db64eaea14edeeddd604d551cc480cca263e9b88380495ff552cd5f35b9afa87703656e0b2de58fb0e98445c8b6911669325"], &(0x7f0000000200)=0x14) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2, 0x5}, 0xfffffffffffffd3a) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r3 = creat(&(0x7f0000000380)='./file0\x00', 0x2) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f00000003c0)={0x0, 0x0, 0x2080, {0x10000, 0x1000, 0x2}, [], "7a406931278e81c0c1671586c73750f61dc14ee8617620d9714b19fd20bbe8a835fe09dcf679a73561a77de18f734670191387755240f9cabff5672bc627e028d52b967fd58a905b6eec6e19a682c4272ae54eeee5c5881b259999629552832411cb06b2eb51a167ed78560541c5c5679e7953fd5da3ca9d54be3ecad419b0f9731c104bc758ff98cb48709180f4346bcbca729ce52404054314f84b1175aff58fd5d2f916db1960f5a51f9ed6080ba3856d6ad47dbda2223e2c6ba89359d0f9eccc1c3a185f3d272ac34173e57ef4cf873d3245497d8a41b773a764dc2115c6829d2f4e1acbde62835f367ba4dfac1db34ff0487183f571a5b755462cc16f93a9ef942edf407ef994111efa49f9cc98e61a41c6a7303188ec64fd07a2941df53c6895c411bda554c39bf5fa729f5554dc72e629d2f9ec8e956f16e296a5fbaa859f75439fe681107843c26c22cc706a9553be537ca0b0097a01923d0c089b5f2c12619a97a4009d2ec41ac4d2d36f88439fb98ea35a51e64cf94209968c707319194060a7d9b91731c5c699e1c57d64121d8fb33df8b7095a443665f0031db95fa1e2ae66f150b7dcb3ec485b935014df79eac0e7f4b11e35477268ccfa3b176dacab065cb5c238219359409ceef3cb805d03721bca3d9523385b86cf70e705351a62600cb4d53b5074390b4d9010a81e51940af91671f2f6fdf5315883e50d865084f18c9481f1d385fac0fe936bf05314a5399af3cec930e25a4c9357c93988962caae9e26f90cb462ab85355cdd82664fd3b553326a7f97814e2109b6748ebc2ff28518d54e056f6c47e519397e94a1c76ec0feb694e308e1c32e0b3b8eaabff85e5e1fe6071718f875a745dfeb9207bfbc310b77d71e847c23a7fba7ca5874c7caf074a90b38dc9dad27cddfc8a87a18f92a0a0a4790d98f18cc0c2ed5390a99c643dcd5426f5c85edde7b42b489eae8fc774ef0d76507616829bdeb762e0e62cd512885b9f978b4cb42d9162da90c1a909a9275217f65f5e2e5a4ce867e891a8caca1b6308de94cadb7a04dbb2d0a8b7488510b9185048c04a80fd859f7df14babe513776798169ccb3a63266b7af12401af2fb7bf1e3f2e8d19cf8d58bd6f4ebe98d71af98c725540ca88265076badb75277423260473aa07d9681b4f7655b317063495aa062ff4b8c2bdb81a98db0a70ab46fffa98ac3cf140c12640d8de4b562c8ee5fd604e88652bad4b9e05ecc52d1513864dd66f972aee92523b22b6400c80b50b410ddd4235dad40e58186d764ea9f3d82522a3ac71777887822afce42f7922b01cbccf041359312d83a64efc1904eed7cf2788056be58313575a0048276c748c3b3b6a3ae8550a66fa019974d02f636ea899d995e3409d057bf4d12250e2623e84dcbcf83ff3d7b1fb847745e5c38224bd4d14f9badf97bd3b54b3561e39d5c796cc3d911bddd111651968b1329f9731acae0b7e68c5767a941726f781b77267d852777fcb7c0d9a0eb5c0e26a88d66d3e32e7f825b0b28d5c6bd91ae829fcaf739b3d7ef898ea113aa10a5fad2e77278ca8fc614c3ba8ca3e6b1ccd96052d37d27f936d3b84acb17a547e18e549fb5715dfbb9a1cbcf4e6d4353197ae0f84a352930127ea80bb6a79a01ff19640a75d05ba21c053d0411dfa1b1795c7dcfdd42f1ce721fe040e61d29fa0e8f31ae270e0aad802e5c7121bd8822c33de176560485fafe27ac8e43c34d356c359deeae67482fda5baa3d1b0ee477d497c1abf16fc7174ac12c03d278c1c8463c3f187db4c1cce49b902e12a41a421db83b318a81a86acf1e06e0adf5ce9e47bca0e464b170ce2bf2cfa9533f14c463dc3bbfb37c838fbbfabfa27500b56c12fa0a809895d38b1a5da176475829f5e8bad85ecde4bd2fcc372298c655e0423219ff8e31500bc5c88fef51e8a8f2cecb545c0a5debfa244c79caf621345308f1e7dc6bcec5511ae21870a11046eeaa33cb1bc64f4e38835fb65a4e3455d8e11a7be2333aba7c63e0901539b0be0ce5336f7cad6526435aed98310895cb5d62588410edbf76ddc59d861bf2a4f3ab0eaf61581ffe0d02e333d2d9313b021c5475949f29eb237b7f6dad10c1b1f5eea1362440eea2cf352c5337f8fb22ac85bbdccf26ff3e5399f1ee5238a48bf528800b3dde5a2a4971c21e1a3ea2f64d18fa13adf718ae7cfa38b17d76482623a5c320ce73f9a82868247cb15376090358bc1166d272aa3d0a2cdde0049ffa344dc79121203e78d661a31f099b2c95ff9fae4434f2fa9aa2c5fcbb6a20ae7c8b9115b415b75bf79e13d4d7765d00683a4f7dd1f54ddf1528dca21ad8d122af72b6b2711d5ef2d943fcd91799d94a520b92fcc0dc58729a226cb805aac173240b036a8f9d1bbd3a747e54536a1eb64d6aceb2e00656ff163fb6096fb152bdac7c8d2a3bc8d6f46ad770049945d0d71a4a4b8c9cf4011d915bf8bc950fa2179e7e5535cf668ce95f14639dfe05a8d7794bf7ddcaaa3eb6befe714131804c0acac45e0f185a8f044230120c11de932ec1a5ef271f4cdc056824e6f1e07a9b50608e6fdc3805244d2d3477f8606e0bba0b635911f8bead1250f048427016ee7e74fd7b3d43d312d3e2715444ee09f3d718bbfc8403c0499de33aa3464eaf27add0a041bd567f767d8c430d851ac25ade943b19e8c264fa2c1d786c4fd7a71fb03f8cfea34a1db5014ba8a888acca7b462354ded9ac7b9df798bcdf1736c91020928bf17ba7992b1667474238ff283387d9145d35848f1b4d0d363a36d442cbf75f30299a074c10a4eb1063f2732ab773f1ff758f021824a5c9cbf2521d09f6f12e08f47f47b8ba406bc9df5872ff4de66d775f6fa1b199c7a3db88542e033f698586313b4d4747a3ecf2496ee97288d1d61826a68339383e8b1ff5af923dd138226cb49e98776cda126b182ad4b9abc6627ce2e570d72f1f70a8b3d595712fcdbffa149f4639ad5fe1862c9b8a6902011b0aa957fc6ad251277c7332a726ae7fdc314c07c1e22a63e764fcc1507d422dfae9aa656b4d9814fa767bcef2810a70f24a0e4aa7465ea24485acd8f12b1d28b38839001a2c906f3e55c58678a15a657a712c6ffadcaa06cdfa6fee10c1e5a620322a35b0aa93c5b93d440d932fc6b0036a2a115b3beb02eb211b11ad31432421aeae0b9f551b25cdb7c27ecb544d66e6a8b1f69c611afdf9c69519fbf65458fcc0f5b55ba02b5472c871d4f3347271f170d1eefcbd6ec43c122fdbce3cc98cc45439213194366dd3930bb9103c20255e5332627f6a2da3160b248ef56314eb826de95182a994fe261b27bd2a76d14a44b7b2b25c0db08e33e436a1eb3e58a909b7d7df3974f06c5e52d75e2bc673ccd57909c1b27b7f2481497885113a456025cb586b549de78298de66dd3bfbddb2ac6ac5e26a9f9ab559626eec2d0e4b15d45b5c07095468af929cc81cefdf9992163eb58ce33cf072d082aab3806c88732177052030347a9d417130ae9d487fb65671ef70a527181018c6b26ecfedfe6afb2d52fc765567f88b4760e2c8cce172b12051f829445666de76306f49469a70cbc5725e722a58a3bac8dddbe30c16f6d4ee4cad5e86b692abb4f1710d36bc4b864eb6567e080a7c0a7649041e8a3428bcfdfe406d4249117e37957ee3d7b02224d3e2448a940fe76f186d4198fc5432e476ed310a3ce9f0c805639abc786d3eb194276463f5c56459bc3854b52a97ee2f4ae325168118ed6ea7b1b0c0a49859e50c2f9cfafaa9fa3476f91ac2e27277dcda59f0e2b177f9fdb0f93b96e7b2302f8f5036b999af1b5e0d37f46d5ccbfb0ff8fa9240a6a44a35cf384285f1e0b4accf96b1f7b59e27ef43c541da3eec54a47d8ec7026a9851f24e42912bdf767aaff0d75ace4d4c02968485b4ffca6ee0b4f977fa42c4f7ac7e2810620de5f5a50afa306c14b9b394cca3fcb900a3bc14f1e8357d2b2c31269e1ab6feadc8a247290f140d47f24c7fcfffc29490d3e6cfb5b0501192591ae5ad1587f63551ae65c75b098da5887806d940b660c3313ea6dad6ca7ea59591f9ae04325937ed4540f3da3c48d135915cc949ea56cf3efa5ebf83832411d2b9f1768987f6918ea75c32587c24c95ceefc706a50d1ecf0d9e6bd276e9f07289db0056905fe7dd7ce04d5c62bdc9a77bf9e15156e23b26821f6e7e231ac347a17e2ff94bf1332b5f5d5b2e7c83417311302ad0d1d5408f9bec62db681492d66da1f7167d8d68c2faf12100cd8d364f9ed3120691b7e8cf98212d565e331ea68f295750570b2b33ae0434c10f0714eab749a4946350041a7781bd3c07713a9153c841767577d258916dd9bf71875b195b982a7dec944471d7ef8b9188fc92450025546725e82828f4ed1fd08bcd666fa41a63d1df850c326c46f86194322d20bef567d09afffa76da1fa6c5d353ca90e394cc28bd015555ed42a2f40879acf97c83d11cabae79d8b7a80ad75e9f13c2c5ec467cf8d9670c5a7545a30a8d977027e6d2405e934a9ad12feba9f6be93317100cc862aa9eeac21ab27bc2f736198468879378b02aac2fa6d39b1f46a59209ee619f37e9643dca941520961ceeb5202e71aa5ecdedf8a153a3c25d538c33c7611e966a729bb8fe977bec7a0dbb94dcf3dae219a4b2664f29b1a225acaccb897450a2acf9de0f8f35f03c36a33127f2f5aa597198caf2226c24db6a726ed9373d1bd7ecb931bc01edbb4b1abe2ad059f7bbc0ea6fe513bd982ef980635e06706298e9cc374e5ce17ff3db64f2ff9b6ea6cfce5d700636c8cbdf59c68567ec8590abfa79b2b093538293d2a1ca6058da24c767797a8dde07960d39434dcf8d1c17882ce45f4bcb745b30410d878c4a4701fbd9ffc5c2f82f2b7eaf53ce4e61ff1947adea66ac65d843edd5750e117ec510be00fabbe28c30031e8cb81bd86baae121c18dcf8f59a67e56671e3368785bfb54fb273e8ae2d516d67d9ccad64ba42c9edbfb20baeed28800db30ec5ab4d1876687ac58e07387037d3218569823546b08f0504d571a884611a3e3d1e116e37c73e551c03c840554e8d8046aca723af592b776d591c4b0f889db6cb39fd5b356ae83b0b335515b240dc823ee2314bd8b1814ec68fceea5d07d84dcc25db70915d79e6a8efa893d34bc04cbe641ab0008e006035db1bdbed49f9fd0ea3e7d2919b81341f6d849ba312e9aeb177c06126ccca620bdb1ab5cf04f25b90c722f9f616e0a7b76d1db0a564838fdd3fe869bed4f09d24098e9bc9eb187f286904a514596515dda1e1a17c2b03b1ab1a71fb811d349e1001131505a225f1452db7023d802ec7c656d1ad4271bcc410f6f84c710632478cdaf409a397107167631d8ba0140a4b53fca5801d142a0372a2f61c4de5fc9223b43b29e397f40395e602c9bdc0e81b07af986b16be120ea8963eb05550babdeb60df7282a757ee4e31ffaa0ac9fe17564de431864bae72ef8f76746d1ed19065c7c33f8d71077c5ef82f018986d31b99ecf4c0867729331799de73b69b88498389e79bf3d60e2b80d0e3490aa62619ece5fe419d3b00a024fc365ba44f194cc83a2ea27758c395905e7d5fdce2da70615d16f337bf9cf990712e282285b3a41c9c3c34b0e31bd3bfd6f6d2d5bbb9c89e88751a58bf8781d6a7325eb0d3000140e7d71acbba552057b0a81448f794cb46eee18c76d83759cd3dfe797bc04e74bc830e16604681953dd59b696c2ea52fa4bb5de7c08e8c4d564d820f1f1bf2b1b619592abffa6c7be5", "282ef4a8514b773b5acc6375c11ba1b0dbd9d8c514fd49ff507c2ff644301bfe65a4022da59a8e31e0e980239cb2ec4173f889b122053a0db293febd389adc8eead598971e6dff337761928ce6e12d76b2198cd8f10a947822a0b567522907153bf4f0a44c4cca3ce9805654d728f493a2361e937308310dca3bf1cbda21576cc58c8a25801d50e0e353db0277c2aa55105e31a0002f4773fa100d691e6ce1bf869c6b5b93c4300f807130d937d986f661d61befa4b963626452bc9524bd79c4fa31081f6ec4827a2cb46806981812cee11259a0a660a3b1916834c721ef36f58f5c6705e2da34b37be3d65ed4253e5a3d5cccca38325727d2d80db5b65bf296688430d05398bad655c3ac1796578510655ccc05a964617dde80bda8a2791edf310aa19f1be5aa8c710d4140ec3d7c8d0498ec8f089aa331c8f05be787b93e8d567e44dcadc8855721dc96705f2eb72973e768bc4b5996e3cb6b642873e9aaea369a3594878975aa3635ae5efd91d95c65f6b2dc052bbe4ce4416fa586d6d2ff5ca14d74e1583ab75978ade15a5095c58a961cf0ed445ddd51ead039faa6c434dce47aca8df4f0ceeb24442502fce0975b0ee6efe47a5f23e68e9cb0aa1b23919d88f008d5a2fb019d64f2e0915b181d13137ed05a9d67f9d2f049f9651578eeb1bc83bafdbd54db702e61c5394f18597b420084a21e0ee49696b79535caf71415f7256a52ad4cb0e6595ae35ce9b9a269698571b72ab28690abe304c83e6bcd07f92713f48af1d75615da8ae6a1f2999f7f7e5e2329fb0bd3f3a27e1588a6e9bcaac7904a668164bf553db13509c95da84830faf507f244528d577cfaee76df58688fba08c395f0af2fe02643159986c40f5f4991d189c627662bf38e19903f0068245877935d9e3664650b58731846f7e552707a1b65ec4a5736e67c37df809b232d3b5dec77d43ee477b61a271c774e68bc6cd5216d126ea18b964f09111c8c4bb3333baeb749a43de374d99eafc6c8bb1c641106b0c53c8f30cc02e9c7deaa9e39feeeaa7e4a4cadf2c1bc106a894de25c83ea45314eeb7d9780321a0f9ef6e79e9348d32e8e55c770ef6fbcc159eb31e7c923b510b002a2ef7ea1d6adb3d47189f4353aa4df3af9b27c1cda0d4ddf6199ce74973b833f8bddfb7a1d9682f50785603857dd76efa95177a354e2e445887400c2a18d543ccd0af40c28a032e2d9198393b0de4807fea5edd37ffedb3c246e381e694073716cd8839f61f4cb9065af7b2f3c5dfad468a718300ba794d8edf72df31ac4258f914cecc596006ec53cc20039ff7386c9e1c895153361526704df7995f3d0433fa30deba0c512531284fc43f54bcca4481dff8928286577123f28b85efafb9c8a13e36a4bac9e0c671630fdbc4bbd093eea718a1d98af5274c78e26424b88d0351de7ed678044476dc7ade977da131c722fa3997c13b26bacdcd6830ea8f6141df2771b0b924e5ee1db39bd6b1eb6ae15f58381d9b9f3c1c75242e3929d3377cf84f2179194c9bf09621c978bc872acb1a150164b927612c5f68b277f473c740da63f87419b69f8db6bf2c7ae0f5174ad97b067ddc6ca0a9b684ad1ad45366ef3ea036d2c3f4d06d5643862c2104097894bf7be2492fb944a0ec4d2a42a4730ed77e7bda1d6f4633ea07d4293757f847acd4382f68ef4a8b6f536b7082b43c514215dc3838b13b9bbf6bee83c2be47f7220ca5000394bd66372ce8d157e11f30b73118ea3b86866e036979f4bbb993100f01f3bdd63f295f2ba86aa182138076174d0edc1fc184a75a203ec13ba20c6b5add4021584f793af2933820be5ec82bdfdc6f2a38d2f3eb65f0f1131c6f19b52016651baba58161afd3f4ac31ce4f33d45c1866ba1979e600051308e11e88025c245af27fc1d16a266e506dcbc165e2a492183315a306df9638ad4faadd6913b7e95ae4303f45429c334167dbec054169d15513d8b7a9f7c245d800b52257168a5671f473a8d2c686f32acfafe938022664671dcbb14f19bcf6efc2a81a136da3fee8b1283bb3aebb3a040e321c9bc5185c250aa96c0d782d079ca68e6744ac4b90f3142826750de2a2edc517d9f55ec4aa369b2f505db3c13edfdca7279e65cb28c429a4a4d4153d7638bba10e128c34ddde4d2ddd1b8d1b4bbc0aa8ca801e82a09e521224f804e551c98dfe3fd5f6ac29874c727d80a17ab6d29cdd88934a0bd87ee1b0805427edf186e0b2d627caf356cb1fd58c6c02c4bfafb96802622ddaed0df1e1af30c65ef27937b16e11d9d0cafad2f6c438bde4f505de0f0d9888dcde39d96e3c5dd49cfe6997cf1c2f484b399a1419161d52f6380a035346cd5499a1eef0b314c41f1be08f01d3fcaf4f55abdf8b410f9968f8406be746daa4521727c910453cdd9e827f7ed4466f5afdd19c62f267b7c96a6de7a4e4f3595765301eca01674a15c40cca127109e556735c7263b7190893cb4168cf1ed921428a1e309c8fbae894fea00e6912811a3665d44702d198fae8be1d11af70039945cf606cfd373c78688ad086bc3ebed51bc2346ed8d7134dc0a760c3d59c4c4637080341399ae12fd3b7ce53982a8dfcc94a8b24c2aa7836fe579157e632aa45e636cce704914f0eeb87bb3f6131dce888897ad9c91db376568af68db3b4e9bdd97cb720ec4312700f2b512d15b43cd72978654bf862bc6227c3d58e0185f6d8c14f5ea04535b9aa87cd26fad43bd1a27aa1a0b208990a3cfac4242ee960105bfefb63a09e5f5d2279bfc758be27b8bcbd48f43f5adec35c0c63c72fbf19b1af8302d73c709321bcfa55adaf5f70d0f89ac1468532a2b90141d819d4cad7a3510bd0d9ce76e76febdf1abe6c387ef8113378fe755e58410a0241f58fd1013c9487da64bcf82b1d4ca993f8211fe19c9f5e5e1b856796a339e085827d3d4aa6038167532773010d985ba35a5e98ed763194fba249ec68eb3ee394e69e203f521c5284735f4e775f4c5c2bddca138730bcd21b149b34327e6a8bf6c3673a09fc5d071b2a193bdb42bb7b3bdcc01bb1f4bfb475964e6d5eb0931189e223c9f34cc0213550e42da8e3008a05b55c7ec45c2ea3c4a619c02ab225ad4c7cd6b44c4e33c0458eaea3fa483b0359b6ad66aace2235dfb66e73951385e06ea4cd36cd2541459a172e08c91b2120996230b78e35e0e7ce4c614089b94f0fe08da7b2a2b79e5d24732575f5b78d205db898e6aec44290518ca959c7e6f944c75b2a438f49ac735a90c79593852ea884c17464177087925966c7bf6fd2d6a7078b9d06033af4048e7ce586dee0b90dfd5fa4fe373ffc76ede9b6ee9c0991539d1c197d721eb8cba33c4ed9a741803d83a34fa0b159988226db7630d762380a693d7d4a1710867c328801d260aae6e56c8d8f95f8df181f3b79f2f05f290362ec0fa25c57f82bc7c7c6cfd94e8e945adfdd8a5e57e0061abc5a139ea5efe1681b6dab8f191a425560bbbabb1f299dbd588bde088134d6bd4b2f57cc67609ec5f9e77a524068a79eecf0a2a1961522b1319bca8163945ec9bad60f80c52b32f4f62773b6be570730467e8196fa24311c36eb61e3844522300dd68bce8022b241548ca208f70ab33e04022af8a6fa60b91c1019420c3c06e56789fba668ef81926fa4708e25c6f39a6985e76ae11ccd3c54a6db1dd70bd5c54b03bf884fe0229117d22a7c91883bdd40bc50ae4e77d8ac11f9448875834231ba288a971aa143c223137450ed45d172f6e3c3915e140bdbf28a4d5ed6a66ed497c7ffa875aa9b7c77d9bada3bfc607f7262fcf3fde774b6bd4aa89fc2999d176a01b328c48d7239417e0dc9b074329a9e1b989aede23c0d35e57122cfc5fc6d69fbefed3979b59480bfb5e7f4ee3be1d7546b231f12ebda92b9f32c47002d1d352b6df1623926aca36565bdce33c5941a9f03b873d5a538ba52963802dcfacbd6603ebc592fd18d891d9fbe31b81577cebc8a7616cb260c07f1f35cd7293092f46285b01c2cdadf6de956d6774d8190fc8592c4b19a102af4905bfec406aec1d6cac67124302cbdca0c697dc575590a387089a54fcd008059b0b8c940d4288d59fa06189537cca0073c4cc3d211f69cd271ce2e1c3949c88397879bc164e82ae9ce93236434cb03578f905099daaaed517d5ece993ea888cc1cd7f20a38735e593941890d9f4b01c2c6c81aae8b554053b8eb5a7a44baf5dc912ebf1348f66966044c7ffd25eca54ab32f883346423ee57bce4098205f12221055aec71d0d776bda44ba4c2275d7da45165b1472c7e4e40504bc800684068a2db3bdadd45e71ee3e2da998553db0a655e1af5245326b77812b5dd5f6dd3a09671620e3187550971678e1e6a5812fe3825433b57ec82d9397141bc53eee0c6b387aca7ad6073c770c1657efe49f164268571a55cb36e5406861c0a5554c53992befedc2f7b556e0b43f19d7f21e650cfbb9afc404122c9f74e2bd12f5f0e8c0108e490fd8f76e16ce18371dadcbb97d0425ad52c50f41b0c129743031611fba22ad775c7f9fe5f101059eaecbcfb05ae699697a3605c40ab9d78000d64b5d0b075f3dadf0bd0f78ee4ff60bce16ee1950e20c04e4bbfd4d39a5aa8408f1df3f9802063ea22ad9f6d52443eb239cd6fbecea91ab278c7fda68ce4291b0d9231272e4e8e4b19a31f6a73dc939f23fc58487e76421d06eec9d86c91b9bd46273a61788b1754eb2ac67677e54c78b8b5de9bf4f1b0f1f0a4cb4f24997f4c27023e9e6aeab43d29bfd58f1988644fbeb8161c0e648fe306a21db8ab48a3d952d5968d8a059e750971d557f14cae076d2d57138da21a5d87f84036b2a45d50e0e2656f04890c90497069f15350ee9edd56ec216f705968179f3f3b992c9d12dc8c059d902e9a40186e61c77424da46cef2b1c13a062ecb579c8568ab6455bbf4c196103bfea4da2c36fbe00d26cc7dd76429957db214fa48d8f71471c6c3f5596aa8590fca370ed1f95bbe05d19df5f1c496ecff8abd0d99f7c5755a3cd7293ac68e3c3dee4da1e75e5a92be1dbd1dcc29bf9ea9d936449f1edead1f1a81de4f81c56a346fabd1849c4f0d9f6b6317879bd26c5afcbf7c77d982835a8067526adad6e4f6e06280c966616f9ac95ba6aaa5a790041c31e1bb78ff25dae188cd90265bf257e841d5cb2585009345cdf7b55c3bf5a87f2af19bc0e9e70dcfab1bda0dc4c9759bd3a1b3906aa8c4d10fb663df1a8bb340e1f81322a9db3210a3dc7ea40973cd161dbadcdf1000a1172be70440b28b0e358b4eaf6c75e7e47e7a2f0c088570c01636aa21c5a8c95a49e376a1459152aa383ee5fdf62e4a0cde562b8b6466327a0eb0a4702a45d997e2a0a0b1f03aebb3e5f78703ec066d5649d4b406ec67c0c47551b70cf908d5ce452894243f75f8d3d592aefe2709f70abf2b21d39cda349183b8421496acc3ac80d6624d3017d48af5bef791596fea6848abf2357a94538dbde6e2291747d4c79932a11fd998a48d1193db48c70cee53c4e56938dccdd5de93684a85dbe272026d81acc9e86eda699a0647c494fdf1914c02141eefbeb380c0d4151b613661cc5a4863d1b9a9b9ba268dc4457fe08e41431e37b8a17d8575687d0ab8e8b1c263975f629595c118d75dfa235cf997bc4844f07ebc9ace3c90acaa94bf84c466349285e85c631c1313da74bda262fc5b6eb799c45907b596dcb7c8885567e7819afa7c33817785d6a2d376c844af65de0635f57d2cb78eca1a4e2510f664b47a92318fa3a6b8ae"}) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000002440)=@assoc_value={r1, 0xffffffffffffffc1}, 0x8) r4 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x1, 0x2) write$FUSE_INIT(r4, &(0x7f0000000300)={0x50, 0x0, 0x8, {0x7, 0x1c, 0x3, 0x1426, 0x9, 0x6, 0xffff, 0xe828}}, 0x50) [ 1795.124671][T23304] binder: 23300:23304 Release 1 refcount change on invalid ref 2 ret -22 [ 1795.159902][T23304] binder: 23300:23304 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 02:04:59 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x86ddffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1795.187994][T23304] binder: 23300:23304 got reply transaction with no transaction stack [ 1795.217718][T23418] binder: 23300:23418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 1795.247544][T23418] binder: 23300:23418 BC_FREE_BUFFER u0000000000000000 no match [ 1795.265036][T23418] binder: 23300:23418 Release 1 refcount change on invalid ref 2 ret -22 [ 1795.273478][T23418] binder: 23300:23418 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 1795.324607][T23418] binder: 23300:23418 got reply transaction with no transaction stack 02:05:00 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x64}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:00 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x80041, 0x0) exit(0x7) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000100)={0x1f, 0x1e, 0xb, 0x13, 0x7, 0x18cc, 0x5, 0x118, 0x5}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x2800, 0x0) ioctl$KVM_NMI(r2, 0xae9a) 02:05:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x88470000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:00 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x88480000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) flock(r0, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x88640000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="000000007e4a6f72def49ad100000000"]], 0x0, 0x0, &(0x7f0000000300)}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@broute={'broute\x00', 0x20, 0x4, 0x500, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000180], 0x0, &(0x7f0000000100), &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x8, 0x3, 'bcsf0\x00', 'rose0\x00', 'lo\x00', 'team0\x00', @empty, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @random="23a4a2f314d0", [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xe8, 0x120}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x7a1, 0x7, 0x6}}}, @common=@AUDIT={'AUDIT\x00', 0x8}]}, @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x2, [{{{0x3, 0x64, 0x11, 'ip6gretap0\x00', 'bcsh0\x00', 'bond0\x00', 'lo\x00', @empty, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @empty, [0x0, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xb8}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x8, 0xffff, 0x81}}}}, {{{0x5, 0x40, 0x600d, 'bridge_slave_0\x00', 'bridge0\x00', 'vxcan1\x00', 'bridge_slave_1\x00', @dev={[], 0x2a}, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0x0, 0x0, 0xff], 0x70, 0xa0, 0xe8}, [@common=@STANDARD={'\x00', 0x8, {0xffffffffffffffff}}]}, @common=@ERROR={'ERROR\x00', 0x20, {"c15c6bd04074c593dde1bc9d4f842e065f18c092756f0d94f0e6db7a9019"}}}]}, {0x0, '\x00', 0x3, 0x0, 0x1, [{{{0x13, 0x1, 0xeabf, 'eql\x00', 'hwsim0\x00', 'veth1_to_bond\x00', 'vlan0\x00', @dev={[], 0xd}, [0x0, 0xff, 0xff, 0x0, 0xff], @dev={[], 0x1e}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0xe0, 0x160, 0x1b0, [@stp={'stp\x00', 0x48, {{0x1, {0xffffffff, 0xffffffff00000001, 0xffffffff96326805, @broadcast, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], 0x1, 0x5, 0x80000001, 0xf9, @random="fc17c24b96c2", [0xff, 0x0, 0xff, 0x0, 0xff], 0x4e23, 0x4e22, 0x9, 0xfff, 0x5, 0x4e8, 0x401, 0xff, 0x80000001, 0xc00000000000000}, 0x160, 0x80}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0xfff, 'syz0\x00', 0x7ff}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x401}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0xfffffffffffffffc, 'syz1\x00', 0x37f4}}}}]}]}, 0x578) 02:05:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x88a8ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1796.051850][T23551] binder_transaction: 11 callbacks suppressed [ 1796.051892][T23551] binder: 23550:23551 transaction failed 29201/-22, size 0-4 line 3201 [ 1796.092315][T23551] kernel msg: ebtables bug: please report to author: bad policy [ 1796.122865][T23554] binder: 23550:23554 transaction failed 29201/-22, size 0-4 line 3201 [ 1796.123206][T23555] kernel msg: ebtables bug: please report to author: bad policy 02:05:00 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x88caffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:01 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6e1}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x400001, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r1, 0xc040564a, &(0x7f0000000100)={0x9, 0x0, 0x3006, 0x628, 0x6, 0x1000000000000000, 0x3}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x89060000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:01 executing program 4: r0 = socket$inet(0x2, 0x1, 0x80) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1796.833143][T23565] binder: 23560:23565 transaction failed 29201/-22, size 0-4 line 3201 02:05:01 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x89ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1796.964246][ C0] net_ratelimit: 16 callbacks suppressed [ 1796.964255][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1796.975761][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1796.981557][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1796.987347][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1797.007953][T23677] binder: 23662:23677 transaction failed 29201/-22, size 0-4 line 3201 02:05:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xffffa888, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:01 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'eql\x00', 0x0}) getsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000000c0)={@remote, @local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xcb, 0x2, 0x4, 0x500, 0x7, 0x10200, r2}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1797.052979][T23686] binder: 23662:23686 transaction failed 29201/-22, size 0-4 line 3201 02:05:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x100, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000200)={0x7, 0x7, 0x1, 0x21d, [], [], [], 0xfff, 0x1, 0x5, 0x2, "08875505df56038d004033ab207ec409"}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000007f968f5d0d12f019000000ad0000000004000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 02:05:01 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xffffca88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1797.227870][T23697] binder_transaction: 10 callbacks suppressed [ 1797.227880][T23697] binder: 23695:23697 got transaction with invalid offsets size, 4 [ 1797.274776][T23697] binder: 23695:23697 transaction failed 29201/-22, size 0-4 line 3201 [ 1797.284259][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1797.290089][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1797.295927][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1797.301692][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1797.335785][ T5] binder_release_work: 10 callbacks suppressed [ 1797.335792][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 1797.534245][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1797.540049][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:05:02 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3f00}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xffffdd86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:02 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111, 0x100f}}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x8000, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000180)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r2, r3}}, 0x18) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:05:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80200, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 1797.659365][T23806] binder: 23804:23806 got transaction with invalid offsets size, 4 [ 1797.708384][T23806] binder: 23804:23806 transaction failed 29201/-22, size 0-4 line 3201 [ 1797.743787][T23811] binder: 23804:23811 got transaction with invalid offsets size, 4 [ 1797.774285][T23811] binder: 23804:23811 transaction failed 29201/-22, size 0-4 line 3201 [ 1797.783286][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1797.790936][T30760] binder: undelivered TRANSACTION_ERROR: 29201 02:05:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000002c0)=""/4096) r1 = socket$inet(0x2, 0x1000000080001, 0x84) pread64(r0, &(0x7f00000000c0)=""/248, 0xf8, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) write$P9_RLINK(r0, &(0x7f0000000040)={0x7, 0x47, 0x1}, 0x7) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 02:05:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xfffff000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:02 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r1, 0x110, 0x5, &(0x7f0000000100)=[0x2, 0x4], 0x2) ioctl(r0, 0xb, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400b00000000000000000000000000000000000700000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) r3 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x14013, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0xac, 0x0, &(0x7f00000002c0)=[@decrefs, @free_buffer={0x40086303, r3}, @reply_sg={0x40486312, {{0x1, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x0, 0x38, &(0x7f0000000180), &(0x7f0000000200)=[0x0, 0x48, 0x0, 0x0, 0x30, 0x38, 0x68]}, 0x10001}}, @reply_sg={0x40486312, {{0x4, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x20, 0x8, &(0x7f0000000240)=[@fda={0x66646185, 0x7, 0x2, 0x2a}], &(0x7f0000000280)=[0x48]}, 0x5}}], 0xe0, 0x0, &(0x7f0000000380)="d4ad51a3190038eb6e798a23769176280f3ca36e34347cf0237d25e88e5ed3eee8e6b03207c713d998023148cecd544523f990b17c2f4887cf40f7efd17d8c718e482e8e9f91ab650526f4219c1a0876aeff83d868c255094dc672171e1b4213f8f45ba187081e8487324a101ab7fd54c1eec7e9330f0c1e74f9f68b848c6f7407cafd34f451c29a7c0cb504e8fee5c0fdfe06a652cd27c2cf8f0bc1345c33ff94100bc5926eda24d8af366689f7c76d4cf0b578777ee997f9de721b856accf7949573fce56d606facd858869cf1393967dae0c74d9eabb4f3312e5c2dd23b74"}) [ 1797.864222][T23819] binder: 23818:23819 got transaction to invalid handle [ 1797.871208][T23819] binder: 23818:23819 transaction failed 29201/-22, size 0-4 line 2994 02:05:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xffffff89, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1797.931912][T23819] binder: 23818:23819 got transaction to invalid handle [ 1797.968340][T23826] binder: 23818:23826 DecRefs 0 refcount change on invalid ref 0 ret -22 02:05:02 executing program 4: r0 = socket$inet(0x2, 0x1000000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0xffffffff, 0x2, 0xffffffffffffa640, 0x7f}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 1797.968899][T23819] binder: 23818:23819 transaction failed 29201/-22, size 0-4 line 2994 [ 1798.008687][T23826] binder: 23818:23826 BC_FREE_BUFFER u0000000000000000 no match 02:05:02 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0xf0ffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1798.070539][T23826] binder: 23818:23826 got reply transaction with no transaction stack [ 1798.124014][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1798.308318][T23834] kasan: CONFIG_KASAN_INLINE enabled [ 1798.314132][T23834] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 1798.325306][T23834] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 1798.332238][T23834] CPU: 0 PID: 23834 Comm: syz-executor.4 Not tainted 5.0.0-rc6-next-20190218 #37 [ 1798.341330][T23834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1798.351593][T23834] RIP: 0010:__list_del_entry_valid+0x85/0xf5 [ 1798.357571][T23834] Code: 0f 84 e1 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 e2 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d 7d [ 1798.377166][T23834] RSP: 0018:ffff8880545cefc8 EFLAGS: 00010247 [ 1798.383231][T23834] RAX: dffffc0000000000 RBX: ffff8880a8100590 RCX: ffffc9000e66f000 [ 1798.391193][T23834] RDX: 0000000000000000 RSI: ffffffff868559c0 RDI: ffff8880a8100598 [ 1798.399277][T23834] RBP: ffff8880545cefe0 R08: ffff888026ade2c0 R09: 0000000000000002 [ 1798.407241][T23834] R10: ffffed1015d05bc7 R11: ffff8880ae82de3b R12: 0000000000000006 [ 1798.415203][T23834] R13: 0000000100000000 R14: ffff8880a8100590 R15: ffff8880545cf188 [ 1798.423167][T23834] FS: 00007f04df8d2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 1798.432103][T23834] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1798.438673][T23834] CR2: 00007f0fe2749028 CR3: 0000000052886000 CR4: 00000000001426f0 [ 1798.446637][T23834] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1798.454599][T23834] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1798.462560][T23834] Call Trace: [ 1798.465864][T23834] sctp_sched_dequeue_common+0x28/0x340 [ 1798.471406][T23834] sctp_sched_prio_dequeue+0xec/0x1a0 [ 1798.476771][T23834] sctp_outq_flush+0xba2/0x2780 [ 1798.481648][T23834] ? sctp_chunkify+0x4b/0x290 [ 1798.486318][T23834] ? __sctp_outq_teardown+0xc60/0xc60 [ 1798.491773][T23834] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1798.498017][T23834] ? sctp_outq_tail+0x68c/0x930 [ 1798.502867][T23834] sctp_outq_uncork+0x6c/0x80 [ 1798.507546][T23834] sctp_do_sm+0x513/0x5380 [ 1798.511978][T23834] ? __lock_acquire+0x55d/0x4710 [ 1798.516909][T23834] ? __sys_sendmsg+0x105/0x1d0 [ 1798.521673][T23834] ? sctp_do_8_2_transport_strike.isra.0+0x940/0x940 [ 1798.528334][T23834] ? perf_trace_lock+0xeb/0x510 [ 1798.533261][T23834] ? mark_held_locks+0xf0/0xf0 [ 1798.538019][T23834] ? zap_class+0x460/0x460 [ 1798.542430][T23834] ? sctp_assoc_bh_rcv+0x2fc/0x660 [ 1798.547541][T23834] ? find_held_lock+0x35/0x130 [ 1798.552321][T23834] ? sctp_assoc_bh_rcv+0x2fc/0x660 [ 1798.557532][T23834] ? kvm_clock_read+0x18/0x30 [ 1798.562219][T23834] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1798.567926][T23834] ? ktime_get+0x208/0x300 [ 1798.572361][T23834] sctp_assoc_bh_rcv+0x343/0x660 [ 1798.577297][T23834] sctp_inq_push+0x1ea/0x290 [ 1798.581965][T23834] sctp_backlog_rcv+0x196/0xbe0 [ 1798.586810][T23834] ? __local_bh_enable_ip+0x15a/0x270 [ 1798.592172][T23834] ? _raw_spin_unlock_bh+0x31/0x40 [ 1798.597290][T23834] ? __local_bh_enable_ip+0x15a/0x270 [ 1798.602741][T23834] ? sctp_hash_obj+0x5e0/0x5e0 [ 1798.607506][T23834] ? __release_sock+0xca/0x3a0 [ 1798.612269][T23834] ? __local_bh_enable_ip+0x15a/0x270 [ 1798.617746][T23834] __release_sock+0x12e/0x3a0 [ 1798.622420][T23834] release_sock+0x59/0x1c0 [ 1798.626835][T23834] sctp_wait_for_connect+0x316/0x540 [ 1798.632119][T23834] ? sctp_get_port+0x180/0x180 [ 1798.636891][T23834] ? finish_wait+0x260/0x260 [ 1798.641472][T23834] ? sctp_datamsg_put+0x36/0x4d0 [ 1798.646421][T23834] ? sctp_primitive_SEND+0xa0/0xd0 [ 1798.651551][T23834] sctp_sendmsg_to_asoc+0x13e3/0x17b0 [ 1798.656931][T23834] ? sctp_clear_owner_w+0x120/0x120 [ 1798.662124][T23834] ? sctp_autobind+0x1f0/0x1f0 [ 1798.666894][T23834] ? lock_downgrade+0x880/0x880 [ 1798.671749][T23834] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1798.678036][T23834] ? kasan_check_read+0x11/0x20 [ 1798.682889][T23834] sctp_sendmsg+0x10a9/0x17e0 [ 1798.687569][T23834] ? sctp_id2assoc+0x2c0/0x2c0 [ 1798.692506][T23834] ? __might_sleep+0x95/0x190 [ 1798.697188][T23834] ? aa_sk_perm+0x288/0x880 [ 1798.701688][T23834] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 1798.707239][T23834] inet_sendmsg+0x147/0x5d0 [ 1798.711742][T23834] ? ipip_gro_receive+0x100/0x100 [ 1798.713686][ T3874] kobject: 'loop3' (00000000d2771ec5): kobject_uevent_env [ 1798.716766][T23834] sock_sendmsg+0xdd/0x130 [ 1798.716787][T23834] ___sys_sendmsg+0x806/0x930 [ 1798.716803][T23834] ? copy_msghdr_from_user+0x430/0x430 [ 1798.716826][T23834] ? kasan_check_read+0x11/0x20 [ 1798.716844][T23834] ? __fget+0x381/0x550 [ 1798.730176][ T3874] kobject: 'loop3' (00000000d2771ec5): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1798.733028][T23834] ? __fget_light+0x1a9/0x230 [ 1798.733048][T23834] ? __fdget+0x1b/0x20 [ 1798.766474][T23834] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1798.772736][T23834] __sys_sendmsg+0x105/0x1d0 [ 1798.777340][T23834] ? __ia32_sys_shutdown+0x80/0x80 [ 1798.782456][T23834] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1798.787921][T23834] ? do_syscall_64+0x26/0x610 [ 1798.792592][T23834] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1798.798654][T23834] ? do_syscall_64+0x26/0x610 [ 1798.803444][T23834] __x64_sys_sendmsg+0x78/0xb0 [ 1798.808204][T23834] do_syscall_64+0x103/0x610 [ 1798.812799][T23834] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1798.815664][ T3874] kobject: 'loop5' (000000001cc23477): kobject_uevent_env [ 1798.818681][T23834] RIP: 0033:0x457e29 [ 1798.818696][T23834] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1798.818710][T23834] RSP: 002b:00007f04df8d1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 02:05:03 executing program 2: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x6400}, 0x0, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:05:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80200, 0x0) ioctl$VIDIOC_S_EDID(r1, 0xc0285629, &(0x7f0000000180)={0x0, 0x3, 0x11cc, [], &(0x7f0000000100)=0xffffffff}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0100000000000000"]], 0x0, 0x0, &(0x7f0000000300)}) 02:05:03 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:05:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendfile(r2, r3, 0x0, 0x50000000000443) write$binfmt_misc(r2, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) 02:05:03 executing program 5: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1798.829751][ T3874] kobject: 'loop5' (000000001cc23477): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1798.849245][T23834] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 1798.849253][T23834] RDX: 0000000000000000 RSI: 000000002001afc8 RDI: 0000000000000003 [ 1798.849260][T23834] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1798.849267][T23834] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f04df8d26d4 [ 1798.849275][T23834] R13: 00000000004c4e21 R14: 00000000004d8ae8 R15: 00000000ffffffff 02:05:03 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1798.849289][T23834] Modules linked in: [ 1798.866953][T23834] ---[ end trace 9cc13382f5cd49d9 ]--- [ 1798.913762][ T3874] kobject: 'loop2' (000000000e70b9e6): kobject_uevent_env [ 1798.928140][ T3874] kobject: 'loop2' (000000000e70b9e6): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1798.939714][T23845] binder: 23838:23845 got transaction with invalid offsets size, 4 [ 1798.954212][ T5] binder: undelivered TRANSACTION_ERROR: 29201 02:05:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$setsig(r0, 0xa, 0x40) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000e5ffffff0000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) [ 1798.964974][T23834] RIP: 0010:__list_del_entry_valid+0x85/0xf5 [ 1798.977623][T23834] Code: 0f 84 e1 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 e2 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d 7d [ 1799.002835][T23834] RSP: 0018:ffff8880545cefc8 EFLAGS: 00010247 02:05:03 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1799.009639][T23834] RAX: dffffc0000000000 RBX: ffff8880a8100590 RCX: ffffc9000e66f000 [ 1799.035203][T23834] RDX: 0000000000000000 RSI: ffffffff868559c0 RDI: ffff8880a8100598 [ 1799.041630][T23861] binder: 23859:23861 got transaction with invalid offsets size, 4 [ 1799.056090][T23834] RBP: ffff8880545cefe0 R08: ffff888026ade2c0 R09: 0000000000000002 [ 1799.083401][T23834] R10: ffffed1015d05bc7 R11: ffff8880ae82de3b R12: 0000000000000006 [ 1799.098991][T23867] binder: 23859:23867 got transaction with invalid offsets size, 4 [ 1799.113087][T23834] R13: 0000000100000000 R14: ffff8880a8100590 R15: ffff8880545cf188 02:05:03 executing program 1: syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty=[0xfffffffffffff002, 0x0, 0x0, 0x700], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30002d, 0x0, 0x0, @ipv4={[0xb, 0x3], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 1799.135583][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1799.138320][T23834] FS: 00007f04df8d2700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 1799.146300][T30760] binder: undelivered TRANSACTION_ERROR: 29201 [ 1799.172678][T23834] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 02:05:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x80000000, 0x24, 0x81, 0x7, 0x1}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x80, 0x0) setsockopt$RDS_GET_MR(r2, 0x114, 0x2, &(0x7f0000001200)={{&(0x7f0000000200)=""/4096, 0x1000}, &(0x7f0000000180), 0x48}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0e0000ffdd000000"]], 0x0, 0x0, &(0x7f0000000300)}) [ 1799.188266][T23834] CR2: 0000000020c00000 CR3: 0000000052886000 CR4: 00000000001426f0 [ 1799.210486][T23834] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1799.227328][T23834] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1799.239018][T23834] Kernel panic - not syncing: Fatal exception [ 1799.246385][T23834] Kernel Offset: disabled [ 1799.250704][T23834] Rebooting in 86400 seconds..