, @mcast2={0xff, 0x3}}, 0x20)
recvfrom$l2tp6(r0, &(0x7f0000000340)=""/4096, 0x1000, 0x1, 0x0, 0x0)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
recvfrom$l2tp6(r0, &(0x7f0000000340)=""/4096, 0x1000, 0x1, 0x0, 0x0) (async)

04:21:16 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0)

04:21:16 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f0000000140), 0x10000, 0x40001)
ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000180)=""/1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r4)
ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/107)

04:21:16 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xffffff9e}, 0x0)

04:21:16 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:16 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
clock_gettime(0x5, &(0x7f0000000000))

04:21:16 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0)

04:21:16 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f0000000140), 0x10000, 0x40001)
ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000180)=""/1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r4)
ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/107)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
syz_open_dev$vcsa(&(0x7f0000000140), 0x10000, 0x40001) (async)
ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000180)=""/1) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r4) (async)
ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/107) (async)

04:21:16 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xfffffff0}, 0x0)

04:21:16 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
clock_gettime(0x5, &(0x7f0000000000))

04:21:16 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/33)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:16 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async)

04:21:16 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:16 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f0000000140), 0x10000, 0x40001)
ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000180)=""/1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r4)
ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/107)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
syz_open_dev$vcsa(&(0x7f0000000140), 0x10000, 0x40001) (async)
ioctl$EVIOCGBITKEY(r3, 0x80404521, &(0x7f0000000180)=""/1) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r4) (async)
ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000000)=""/107) (async)

04:21:16 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
clock_gettime(0x5, &(0x7f0000000000))

04:21:16 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xf0ffffffffffff}, 0x0)

04:21:16 executing program 1:
write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x2, {{0x2, 0x1, 0x2}, 0x1}}, 0x18)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000100)={"6d98bc6d3182c4a7fc06369454c59bacd790424108914661a4b4a28b605a", 0xb6de, 0xe0, 0x800, [0x7, 0x10000, 0x2c5034d7, 0x8, 0x5, 0x42, 0x0, 0x3, 0xffff, 0x3, 0x64ad, 0x7, 0x2, 0x0, 0x5, 0x7, 0xabb0, 0x66]})

04:21:16 executing program 2:
syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(0xffffffffffffffff, 0xc0189436, &(0x7f0000000080))

04:21:16 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/33)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/33) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:16 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x100000000000000}, 0x0)

04:21:16 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000000)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10)

04:21:17 executing program 2:
syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(0xffffffffffffffff, 0xc0189436, &(0x7f0000000080))

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'ip6_vti0\x00', <r1=>0x0, 0x29, 0x20, 0x88, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x8, 0x4, 0x4}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0xe1, 0x60, 0x8, 0x5, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x1, 0x2, 0xcc}})

04:21:17 executing program 1:
write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x2, {{0x2, 0x1, 0x2}, 0x1}}, 0x18)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000100)={"6d98bc6d3182c4a7fc06369454c59bacd790424108914661a4b4a28b605a", 0xb6de, 0xe0, 0x800, [0x7, 0x10000, 0x2c5034d7, 0x8, 0x5, 0x42, 0x0, 0x3, 0xffff, 0x3, 0x64ad, 0x7, 0x2, 0x0, 0x5, 0x7, 0xabb0, 0x66]})
write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x2, {{0x2, 0x1, 0x2}, 0x1}}, 0x18) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000100)={"6d98bc6d3182c4a7fc06369454c59bacd790424108914661a4b4a28b605a", 0xb6de, 0xe0, 0x800, [0x7, 0x10000, 0x2c5034d7, 0x8, 0x5, 0x42, 0x0, 0x3, 0xffff, 0x3, 0x64ad, 0x7, 0x2, 0x0, 0x5, 0x7, 0xabb0, 0x66]}) (async)

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/33)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/33) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x200000000000000}, 0x0)

04:21:17 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000000)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10)

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x3, 0x4c4000)
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, 0x0, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x598, 0x0)
ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000040)=""/45)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000140)=""/205)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:17 executing program 2:
syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(0xffffffffffffffff, 0xc0189436, &(0x7f0000000080))

04:21:17 executing program 1:
write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x2, {{0x2, 0x1, 0x2}, 0x1}}, 0x18)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000100)={"6d98bc6d3182c4a7fc06369454c59bacd790424108914661a4b4a28b605a", 0xb6de, 0xe0, 0x800, [0x7, 0x10000, 0x2c5034d7, 0x8, 0x5, 0x42, 0x0, 0x3, 0xffff, 0x3, 0x64ad, 0x7, 0x2, 0x0, 0x5, 0x7, 0xabb0, 0x66]})
write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x2, {{0x2, 0x1, 0x2}, 0x1}}, 0x18) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000100)={"6d98bc6d3182c4a7fc06369454c59bacd790424108914661a4b4a28b605a", 0xb6de, 0xe0, 0x800, [0x7, 0x10000, 0x2c5034d7, 0x8, 0x5, 0x42, 0x0, 0x3, 0xffff, 0x3, 0x64ad, 0x7, 0x2, 0x0, 0x5, 0x7, 0xabb0, 0x66]}) (async)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x300000000000000}, 0x0)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'ip6_vti0\x00', <r1=>0x0, 0x29, 0x20, 0x88, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x8, 0x4, 0x4}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0xe1, 0x60, 0x8, 0x5, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x1, 0x2, 0xcc}})

04:21:17 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(r0, 0xc0189436, 0x0)

04:21:17 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000000)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000200)}}, 0x10)

04:21:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x6401)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0xff, 0xb, 0x7ff, 0x7ea9, "3c7470172b72de02606bb0f3ec91fcdf045d32781bc0ee9f7317806dddad1e6d"})

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x400000000000000}, 0x0)

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x3, 0x4c4000) (async)
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, 0x0, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x598, 0x0)
ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000040)=""/45)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 64)
ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000140)=""/205) (rerun: 64)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:17 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(r0, 0xc0189436, 0x0)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'ip6_vti0\x00', <r1=>0x0, 0x29, 0x20, 0x88, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x8, 0x4, 0x4}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0xe1, 0x60, 0x8, 0x5, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x1, 0x2, 0xcc}})
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x29, 0x20, 0x88, 0x9, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x8, 0x4, 0x4}}) (async)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0xe1, 0x60, 0x8, 0x5, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7800, 0x1, 0x2, 0xcc}}) (async)

04:21:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x6401)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 64)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0xff, 0xb, 0x7ff, 0x7ea9, "3c7470172b72de02606bb0f3ec91fcdf045d32781bc0ee9f7317806dddad1e6d"}) (rerun: 64)

04:21:17 executing program 3:
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000100)=""/162)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/32)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f00000001c0)=""/110)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x20008041, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x700000000000000}, 0x0)

04:21:17 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x1)
ioctl$EVIOCSREP(r0, 0xc0189436, 0x0)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x20008041, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:17 executing program 3:
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000100)=""/162)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/32)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f00000001c0)=""/110)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000100)=""/162) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/32) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f00000001c0)=""/110) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x800000000000000}, 0x0)

04:21:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xf0ffffff}, 0x0)

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x3, 0x4c4000) (async)
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, 0x0, 0x0) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x598, 0x0)
ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000040)=""/45) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000140)=""/205) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x20008041, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x20008041, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:17 executing program 3:
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000100)=""/162) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/32)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f00000001c0)=""/110) (async, rerun: 64)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (rerun: 64)

04:21:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x6401)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0xff, 0xb, 0x7ff, 0x7ea9, "3c7470172b72de02606bb0f3ec91fcdf045d32781bc0ee9f7317806dddad1e6d"})

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/175)

04:21:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x8000000}, 0x0)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
recvfrom$l2tp6(r1, &(0x7f0000000000)=""/32, 0x20, 0x2062, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xe00000000000000}, 0x0)

04:21:17 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = socket(0xf, 0x1, 0x0)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000040)={r1, 0x81})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000000)=[0x8, 0x8])
syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x240)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
recvfrom$l2tp6(r1, &(0x7f0000000000)=""/32, 0x20, 0x2062, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
recvfrom$l2tp6(r1, &(0x7f0000000000)=""/32, 0x20, 0x2062, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xf00000000000000}, 0x0)

04:21:17 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/175)

04:21:17 executing program 2:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000340)=""/144)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x44, 0x0, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}]}, 0x44}}, 0x44804)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="27000004bc2cdbf74453d685aefe9c8309bd5b70a46d7bbe61c4ac91811d5dd97e094c7fdfca6d898d691b36a284d566f04a1a7b56d0f5ba3a93d7b9684f446f71c9dc5719e7419972219c7ad2974b9df31a13db9f07b0582e2302fdb07b1a2e203895a64c55d210f8dcaeec89be6d3e1ac0a08c03ad0055ca75165512b348b4a19dc20eb350f53ba6e2559f3418e75fee3b9930afeaf38e00"/168, @ANYRES16=0x0, @ANYBLOB="000426bd7000fbdbdf250800000005001200db000000"], 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:17 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = socket(0xf, 0x1, 0x0)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000040)={r1, 0x81})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000000)=[0x8, 0x8])
syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x240)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
socket(0xf, 0x1, 0x0) (async)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000040)={r1, 0x81}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000000)=[0x8, 0x8]) (async)
syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x240) (async)

04:21:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x7, 0x69c043)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:17 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
recvfrom$l2tp6(r1, &(0x7f0000000000)=""/32, 0x20, 0x2062, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
recvfrom$l2tp6(r1, &(0x7f0000000000)=""/32, 0x20, 0x2062, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:17 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x3e39000000000000}, 0x0)

04:21:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x7, 0x69c043)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x7, 0x69c043) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x2000000}, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/175)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/175) (async)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x6000000000000000}, 0x0)

04:21:18 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
r1 = socket(0xf, 0x1, 0x0)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000040)={r1, 0x81})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000000)=[0x8, 0x8])
syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x240)

04:21:18 executing program 2:
ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000100)=""/159)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:18 executing program 0:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'syztnl2\x00', <r1=>0x0, 0x4, 0x6, 0x6, 0x929, 0x0, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x700, 0x700, 0xffffffff, 0xffff8000}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r1, 0x29, 0x9, 0x65, 0xc4, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x20, 0x4, 0x1}})

04:21:18 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x7, 0x69c043)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x80000004, 0x0)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000040)=""/53)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:18 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x9effffff00000000}, 0x0)

04:21:18 executing program 0:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'syztnl2\x00', <r1=>0x0, 0x4, 0x6, 0x6, 0x929, 0x0, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x700, 0x700, 0xffffffff, 0xffff8000}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r1, 0x29, 0x9, 0x65, 0xc4, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x20, 0x4, 0x1}})

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x80000004, 0x0)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000040)=""/53) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:18 executing program 1:
prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/73)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xf0ffffff00000000}, 0x0)

04:21:18 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x80000004, 0x0)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000040)=""/53)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f0000000000), 0x80000004, 0x0) (async)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000040)=""/53) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:18 executing program 1:
prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/73)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/73) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:18 executing program 0:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async, rerun: 32)
r0 = socket$l2tp6(0xa, 0x2, 0x73) (rerun: 32)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 64)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async, rerun: 64)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'syztnl2\x00', <r1=>0x0, 0x4, 0x6, 0x6, 0x929, 0x0, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x700, 0x700, 0xffffffff, 0xffff8000}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r1, 0x29, 0x9, 0x65, 0xc4, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x20, 0x4, 0x1}})

04:21:18 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xffffff7f00000000}, 0x0)

04:21:18 executing program 1:
prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/73)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/73) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x4)

04:21:18 executing program 3:
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f0000000100)=""/148)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x6])

04:21:18 executing program 2:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xffffffff00000000}, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x4)

04:21:18 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x10000, 0x1}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:18 executing program 1:
syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x10c80)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x800)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000000c0)=""/7)
syz_open_dev$vcsa(&(0x7f0000000080), 0x1000, 0x101080)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0)
ioctl$EVIOCSREP(r1, 0x541b, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="3700045c5c4f0009004dc24d"], 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x400, 0x70bd25, 0xfff}, 0x14}, 0x1, 0x0, 0x0, 0x20008050}, 0x4004001)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
bind$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x7ff, @mcast1, 0x1}, 0x20)
write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="230000006f0100020080010000000700"/35], 0x23)

04:21:18 executing program 3:
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f0000000100)=""/148)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x6])

04:21:18 executing program 2:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0xfffffffffffff000}, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x4)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)=0x4) (async)

04:21:18 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x10000, 0x1}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x10000, 0x1}, 0x0) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:18 executing program 3:
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f0000000100)=""/148)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x6])
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f0000000100)=""/148) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x6]) (async)

04:21:18 executing program 1:
syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x10c80) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x800)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000000c0)=""/7)
syz_open_dev$vcsa(&(0x7f0000000080), 0x1000, 0x101080) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0)
ioctl$EVIOCSREP(r1, 0x541b, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="3700045c5c4f0009004dc24d"], 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x400, 0x70bd25, 0xfff}, 0x14}, 0x1, 0x0, 0x0, 0x20008050}, 0x4004001) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
bind$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x7ff, @mcast1, 0x1}, 0x20) (async)
write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="230000006f0100020080010000000700"/35], 0x23)

04:21:18 executing program 2:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x2}, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
clock_gettime(0x0, &(0x7f0000000000)={<r2=>0x0, <r3=>0x0})
write$evdev(r1, &(0x7f0000000100)=[{{}, 0x5, 0x988, 0x184e}, {{r2, r3/1000+10000}, 0x1, 0x484, 0x27}, {{0x77359400}, 0x2, 0x2}, {{}, 0x17, 0x8, 0x10000}, {{}, 0x2, 0x1, 0xfe}], 0x78)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r4)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:18 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffefffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:18 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x10000, 0x1}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}, 0x10000, 0x1}, 0x0) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:18 executing program 1:
syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x10c80) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async, rerun: 64)
syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x800) (async, rerun: 64)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000000c0)=""/7) (async)
syz_open_dev$vcsa(&(0x7f0000000080), 0x1000, 0x101080)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 32)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) (async, rerun: 32)
ioctl$EVIOCSREP(r1, 0x541b, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 64)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 64)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="3700045c5c4f0009004dc24d"], 0x14}}, 0x0) (async, rerun: 32)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x400, 0x70bd25, 0xfff}, 0x14}, 0x1, 0x0, 0x0, 0x20008050}, 0x4004001) (async, rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async, rerun: 32)
bind$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x7ff, @mcast1, 0x1}, 0x20) (async, rerun: 32)
write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="230000006f0100020080010000000700"/35], 0x23)

04:21:18 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:18 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x3}, 0x0)

04:21:18 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
clock_gettime(0x0, &(0x7f0000000000)={<r2=>0x0, <r3=>0x0})
write$evdev(r1, &(0x7f0000000100)=[{{}, 0x5, 0x988, 0x184e}, {{r2, r3/1000+10000}, 0x1, 0x484, 0x27}, {{0x77359400}, 0x2, 0x2}, {{}, 0x17, 0x8, 0x10000}, {{}, 0x2, 0x1, 0xfe}], 0x78)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r4)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
clock_gettime(0x0, &(0x7f0000000000)) (async)
write$evdev(r1, &(0x7f0000000100)=[{{}, 0x5, 0x988, 0x184e}, {{r2, r3/1000+10000}, 0x1, 0x484, 0x27}, {{0x77359400}, 0x2, 0x2}, {{}, 0x17, 0x8, 0x10000}, {{}, 0x2, 0x1, 0xfe}], 0x78) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r4) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3, 0x1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_macvtap\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x1b}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}}, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000140), 0x4, 0xb3d2c3a3d093c03a)
recvfrom$l2tp6(r2, &(0x7f0000000340)=""/248, 0xf8, 0x140, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:19 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffefffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x4}, 0x0)

04:21:19 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:19 executing program 1:
setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000)=0xeb6, 0x4)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000080)={&(0x7f0000000100)={{@local, 0x1c2}, {@any, 0xff}, 0x400, "ceb2fccbc78f754f19253db6bb1b5fef1cc50116fe76955b58adbc3b0303b4f8e8c9e32fdb7d78d5a31e4c017499a7ff89989830771fab0405e449817ad77e1e0f8dddaae8d07c11d4a6cc6359ffd56ea69282bd07b745e6316550dd09fe1056c3c379c454ce10a3fd57d9eb7e31df13ff842430f32badf6a09d365f20888cdeb2042d75162c5b816322c066ec07d79327d51bb01a10f32c568fd7bbf254f3334413343d7812f248e7227699edc3c09f309ac6d3e5d84613a4b3d8d0fc5a8d3f57f99f4ba9276b342a41e219df73197151b4ea06a552610e4348aabf19c0180e20c25756b6b61b40ad238fc74f13532657aceed9ee59642626b914fbd88417166606921343dbe6e15f15e51871d614bc210aa00b079491fe68175884fbc078ac118198c1be214aec31b4a296ca974fbfd9c7b6958a3dca04c5176f97bf6c1fdae5d248253cef54ed94489237999b6ae10c261fff1a3466aa6e43a5e4daf7ddd9235410d6125366c44ed80590fa87099f21bd2141c59d24846dad4e7bc356c9b1aa6b263d204fb34b94ce0511ec25b896a2f104a2f59563c6f87b6370359c92f9e1a91553445beb1cea7b9b45faae932955bf339f20e78975a1973e2069be49d9baaeae2db3ca7f62b621e926934ad375bb007bcd3d730f2db632641543e3cf76c094b6b63d51d3ad15f0d6abdb0876857f1392ebb7f77055adf8e76a5f2ed3700134ca8cb6c8fb81ab1465a8d8a8408012de334609ae5cba45aedd7412f4228d5192272feaca2203cef7fd0f1d2ae5f62e0d9095e6aff6b6980bc3aef62cfa84ce89731f6d2373e2f5f72d15fc79c35303768d447f55fae6876ea84c49f17e399409f1e78f90847fcfacf960ff3ae7fa9f256b0f4ca7afbe720a140894af7ff26805edfdbe3d73c7a2b9aec3156a555249439c9e5ccc54b830dd5080e96a43c724809bec7372a6386cc4debc700a0a398b63671c0a89411c823a59a5430a0456ecce84886e308b86cd7b83bc5149d1485edfdea15961c11fffec8109ae20288679e87692f998f472507799511d1b77f64cdc45d1c6307e293cecacc800cf3cbb99b3510bfda94057782392d42d1fce030bc707af64fcdba03584e5610365e7987ab229dc6e74e286fc28c8bce82b6574423c98cc824cd8664b78b617cf363805b98564464c01efa3d928d212c14a525230bd626178d249999b0af2069a138f2a5a9689d02065365afc6d871a225eada0443514f87b208fed962731f42078e7f87b37e629309794e17314a1de9fe36e58b91f9a783a894238df12516e3034453b259268d88db1b9e801c215e91c544c50ed4380b621d91c157b11a9b9b44de42e8e9b3a7a6f704e8ff487ca542c4da926140e104a2592b4f9341cf747121afa7cb4851cfff10dac55ee05fe6d2e66b6cb777d8a6c285d5eededb3e8cfeeb01458"}, 0xffffffffffffffbc, 0xfff})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000040)=""/52)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7ba)
r2 = syz_open_dev$vcsa(&(0x7f0000000780), 0x5, 0x82)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f00000007c0)={0xff, 0xc9, 0x3, 0x2fd, 0x401, 0x9})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$tipc(r1, &(0x7f0000000740)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x1}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="009a0584816a6ac674a06a69350f2e8385cabcdad4b4b722f656f32a216fa573eff2bc931f123e5b552e693f1eebd9733ad251", 0x33}, {&(0x7f00000005c0)="041cf164bd7d2665482fbbe8dd72042e6774c72d2fd53134ddbc3cb0c117ba6b3334f43a5b248c583993948c90891e6c4136a7a1870ffc8101f4db80be5b7e2307d523cb21ec9d6e56f913d5c066f050c6f7c8df4aefb3d02c15ddfb2a94942ab93ae82d7700aa39a4f2e63432905221c9c95f1c5286e5d81d51fab4a383262150d3969f5c1a70d0f2a32d8f54909d76a57ab45ef89bff1f70d537108a75", 0x9e}, {&(0x7f0000000680)="8afb32602115c6", 0x7}], 0x3, &(0x7f0000000700)="fc0c441aae8fd318e84306d236d987a1a3c33e369ff52f68fc5097fdef72bf40d7d46a6cd27b7cf395ef40c3e41d799737e96d9798e1c0", 0x37, 0x810}, 0x40040)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3, 0x1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_macvtap\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x1b}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}}, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000140), 0x4, 0xb3d2c3a3d093c03a)
recvfrom$l2tp6(r2, &(0x7f0000000340)=""/248, 0xf8, 0x140, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
bind$l2tp6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3, 0x1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_macvtap\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x1b}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}}, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000140), 0x4, 0xb3d2c3a3d093c03a) (async)
recvfrom$l2tp6(r2, &(0x7f0000000340)=""/248, 0xf8, 0x140, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:19 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
clock_gettime(0x0, &(0x7f0000000000)={<r2=>0x0, <r3=>0x0})
write$evdev(r1, &(0x7f0000000100)=[{{}, 0x5, 0x988, 0x184e}, {{r2, r3/1000+10000}, 0x1, 0x484, 0x27}, {{0x77359400}, 0x2, 0x2}, {{}, 0x17, 0x8, 0x10000}, {{}, 0x2, 0x1, 0xfe}], 0x78)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r4)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x7}, 0x0)

04:21:19 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffefffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:19 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x300}, 0x0)

04:21:19 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x40, 0xff])

04:21:19 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x402)
ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000100)=""/210)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x3])
setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000040)=0x9, 0x4)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x8}, 0x0)

04:21:19 executing program 1:
setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000)=0xeb6, 0x4) (async, rerun: 32)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000080)={&(0x7f0000000100)={{@local, 0x1c2}, {@any, 0xff}, 0x400, "ceb2fccbc78f754f19253db6bb1b5fef1cc50116fe76955b58adbc3b0303b4f8e8c9e32fdb7d78d5a31e4c017499a7ff89989830771fab0405e449817ad77e1e0f8dddaae8d07c11d4a6cc6359ffd56ea69282bd07b745e6316550dd09fe1056c3c379c454ce10a3fd57d9eb7e31df13ff842430f32badf6a09d365f20888cdeb2042d75162c5b816322c066ec07d79327d51bb01a10f32c568fd7bbf254f3334413343d7812f248e7227699edc3c09f309ac6d3e5d84613a4b3d8d0fc5a8d3f57f99f4ba9276b342a41e219df73197151b4ea06a552610e4348aabf19c0180e20c25756b6b61b40ad238fc74f13532657aceed9ee59642626b914fbd88417166606921343dbe6e15f15e51871d614bc210aa00b079491fe68175884fbc078ac118198c1be214aec31b4a296ca974fbfd9c7b6958a3dca04c5176f97bf6c1fdae5d248253cef54ed94489237999b6ae10c261fff1a3466aa6e43a5e4daf7ddd9235410d6125366c44ed80590fa87099f21bd2141c59d24846dad4e7bc356c9b1aa6b263d204fb34b94ce0511ec25b896a2f104a2f59563c6f87b6370359c92f9e1a91553445beb1cea7b9b45faae932955bf339f20e78975a1973e2069be49d9baaeae2db3ca7f62b621e926934ad375bb007bcd3d730f2db632641543e3cf76c094b6b63d51d3ad15f0d6abdb0876857f1392ebb7f77055adf8e76a5f2ed3700134ca8cb6c8fb81ab1465a8d8a8408012de334609ae5cba45aedd7412f4228d5192272feaca2203cef7fd0f1d2ae5f62e0d9095e6aff6b6980bc3aef62cfa84ce89731f6d2373e2f5f72d15fc79c35303768d447f55fae6876ea84c49f17e399409f1e78f90847fcfacf960ff3ae7fa9f256b0f4ca7afbe720a140894af7ff26805edfdbe3d73c7a2b9aec3156a555249439c9e5ccc54b830dd5080e96a43c724809bec7372a6386cc4debc700a0a398b63671c0a89411c823a59a5430a0456ecce84886e308b86cd7b83bc5149d1485edfdea15961c11fffec8109ae20288679e87692f998f472507799511d1b77f64cdc45d1c6307e293cecacc800cf3cbb99b3510bfda94057782392d42d1fce030bc707af64fcdba03584e5610365e7987ab229dc6e74e286fc28c8bce82b6574423c98cc824cd8664b78b617cf363805b98564464c01efa3d928d212c14a525230bd626178d249999b0af2069a138f2a5a9689d02065365afc6d871a225eada0443514f87b208fed962731f42078e7f87b37e629309794e17314a1de9fe36e58b91f9a783a894238df12516e3034453b259268d88db1b9e801c215e91c544c50ed4380b621d91c157b11a9b9b44de42e8e9b3a7a6f704e8ff487ca542c4da926140e104a2592b4f9341cf747121afa7cb4851cfff10dac55ee05fe6d2e66b6cb777d8a6c285d5eededb3e8cfeeb01458"}, 0xffffffffffffffbc, 0xfff}) (async, rerun: 32)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000040)=""/52)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7ba)
r2 = syz_open_dev$vcsa(&(0x7f0000000780), 0x5, 0x82)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f00000007c0)={0xff, 0xc9, 0x3, 0x2fd, 0x401, 0x9}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$tipc(r1, &(0x7f0000000740)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x1}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="009a0584816a6ac674a06a69350f2e8385cabcdad4b4b722f656f32a216fa573eff2bc931f123e5b552e693f1eebd9733ad251", 0x33}, {&(0x7f00000005c0)="041cf164bd7d2665482fbbe8dd72042e6774c72d2fd53134ddbc3cb0c117ba6b3334f43a5b248c583993948c90891e6c4136a7a1870ffc8101f4db80be5b7e2307d523cb21ec9d6e56f913d5c066f050c6f7c8df4aefb3d02c15ddfb2a94942ab93ae82d7700aa39a4f2e63432905221c9c95f1c5286e5d81d51fab4a383262150d3969f5c1a70d0f2a32d8f54909d76a57ab45ef89bff1f70d537108a75", 0x9e}, {&(0x7f0000000680)="8afb32602115c6", 0x7}], 0x3, &(0x7f0000000700)="fc0c441aae8fd318e84306d236d987a1a3c33e369ff52f68fc5097fdef72bf40d7d46a6cd27b7cf395ef40c3e41d799737e96d9798e1c0", 0x37, 0x810}, 0x40040)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async, rerun: 64)
r1 = socket$l2tp6(0xa, 0x2, 0x73) (rerun: 64)
bind$l2tp6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3, 0x1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_macvtap\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x1b}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}}, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000140), 0x4, 0xb3d2c3a3d093c03a)
recvfrom$l2tp6(r2, &(0x7f0000000340)=""/248, 0xf8, 0x140, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, 0x0, 0x0)

04:21:19 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x402)
ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000100)=""/210) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x3]) (async, rerun: 64)
setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000040)=0x9, 0x4) (rerun: 64)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, 0x0, 0x0)

04:21:19 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x40, 0xff])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x40, 0xff]) (async)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xe}, 0x0)

04:21:19 executing program 1:
setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000)=0xeb6, 0x4)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000080)={&(0x7f0000000100)={{@local, 0x1c2}, {@any, 0xff}, 0x400, "ceb2fccbc78f754f19253db6bb1b5fef1cc50116fe76955b58adbc3b0303b4f8e8c9e32fdb7d78d5a31e4c017499a7ff89989830771fab0405e449817ad77e1e0f8dddaae8d07c11d4a6cc6359ffd56ea69282bd07b745e6316550dd09fe1056c3c379c454ce10a3fd57d9eb7e31df13ff842430f32badf6a09d365f20888cdeb2042d75162c5b816322c066ec07d79327d51bb01a10f32c568fd7bbf254f3334413343d7812f248e7227699edc3c09f309ac6d3e5d84613a4b3d8d0fc5a8d3f57f99f4ba9276b342a41e219df73197151b4ea06a552610e4348aabf19c0180e20c25756b6b61b40ad238fc74f13532657aceed9ee59642626b914fbd88417166606921343dbe6e15f15e51871d614bc210aa00b079491fe68175884fbc078ac118198c1be214aec31b4a296ca974fbfd9c7b6958a3dca04c5176f97bf6c1fdae5d248253cef54ed94489237999b6ae10c261fff1a3466aa6e43a5e4daf7ddd9235410d6125366c44ed80590fa87099f21bd2141c59d24846dad4e7bc356c9b1aa6b263d204fb34b94ce0511ec25b896a2f104a2f59563c6f87b6370359c92f9e1a91553445beb1cea7b9b45faae932955bf339f20e78975a1973e2069be49d9baaeae2db3ca7f62b621e926934ad375bb007bcd3d730f2db632641543e3cf76c094b6b63d51d3ad15f0d6abdb0876857f1392ebb7f77055adf8e76a5f2ed3700134ca8cb6c8fb81ab1465a8d8a8408012de334609ae5cba45aedd7412f4228d5192272feaca2203cef7fd0f1d2ae5f62e0d9095e6aff6b6980bc3aef62cfa84ce89731f6d2373e2f5f72d15fc79c35303768d447f55fae6876ea84c49f17e399409f1e78f90847fcfacf960ff3ae7fa9f256b0f4ca7afbe720a140894af7ff26805edfdbe3d73c7a2b9aec3156a555249439c9e5ccc54b830dd5080e96a43c724809bec7372a6386cc4debc700a0a398b63671c0a89411c823a59a5430a0456ecce84886e308b86cd7b83bc5149d1485edfdea15961c11fffec8109ae20288679e87692f998f472507799511d1b77f64cdc45d1c6307e293cecacc800cf3cbb99b3510bfda94057782392d42d1fce030bc707af64fcdba03584e5610365e7987ab229dc6e74e286fc28c8bce82b6574423c98cc824cd8664b78b617cf363805b98564464c01efa3d928d212c14a525230bd626178d249999b0af2069a138f2a5a9689d02065365afc6d871a225eada0443514f87b208fed962731f42078e7f87b37e629309794e17314a1de9fe36e58b91f9a783a894238df12516e3034453b259268d88db1b9e801c215e91c544c50ed4380b621d91c157b11a9b9b44de42e8e9b3a7a6f704e8ff487ca542c4da926140e104a2592b4f9341cf747121afa7cb4851cfff10dac55ee05fe6d2e66b6cb777d8a6c285d5eededb3e8cfeeb01458"}, 0xffffffffffffffbc, 0xfff})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000040)=""/52)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7ba)
r2 = syz_open_dev$vcsa(&(0x7f0000000780), 0x5, 0x82)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f00000007c0)={0xff, 0xc9, 0x3, 0x2fd, 0x401, 0x9})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$tipc(r1, &(0x7f0000000740)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x1}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="009a0584816a6ac674a06a69350f2e8385cabcdad4b4b722f656f32a216fa573eff2bc931f123e5b552e693f1eebd9733ad251", 0x33}, {&(0x7f00000005c0)="041cf164bd7d2665482fbbe8dd72042e6774c72d2fd53134ddbc3cb0c117ba6b3334f43a5b248c583993948c90891e6c4136a7a1870ffc8101f4db80be5b7e2307d523cb21ec9d6e56f913d5c066f050c6f7c8df4aefb3d02c15ddfb2a94942ab93ae82d7700aa39a4f2e63432905221c9c95f1c5286e5d81d51fab4a383262150d3969f5c1a70d0f2a32d8f54909d76a57ab45ef89bff1f70d537108a75", 0x9e}, {&(0x7f0000000680)="8afb32602115c6", 0x7}], 0x3, &(0x7f0000000700)="fc0c441aae8fd318e84306d236d987a1a3c33e369ff52f68fc5097fdef72bf40d7d46a6cd27b7cf395ef40c3e41d799737e96d9798e1c0", 0x37, 0x810}, 0x40040)
setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000)=0xeb6, 0x4) (async)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000080)={&(0x7f0000000100)={{@local, 0x1c2}, {@any, 0xff}, 0x400, "ceb2fccbc78f754f19253db6bb1b5fef1cc50116fe76955b58adbc3b0303b4f8e8c9e32fdb7d78d5a31e4c017499a7ff89989830771fab0405e449817ad77e1e0f8dddaae8d07c11d4a6cc6359ffd56ea69282bd07b745e6316550dd09fe1056c3c379c454ce10a3fd57d9eb7e31df13ff842430f32badf6a09d365f20888cdeb2042d75162c5b816322c066ec07d79327d51bb01a10f32c568fd7bbf254f3334413343d7812f248e7227699edc3c09f309ac6d3e5d84613a4b3d8d0fc5a8d3f57f99f4ba9276b342a41e219df73197151b4ea06a552610e4348aabf19c0180e20c25756b6b61b40ad238fc74f13532657aceed9ee59642626b914fbd88417166606921343dbe6e15f15e51871d614bc210aa00b079491fe68175884fbc078ac118198c1be214aec31b4a296ca974fbfd9c7b6958a3dca04c5176f97bf6c1fdae5d248253cef54ed94489237999b6ae10c261fff1a3466aa6e43a5e4daf7ddd9235410d6125366c44ed80590fa87099f21bd2141c59d24846dad4e7bc356c9b1aa6b263d204fb34b94ce0511ec25b896a2f104a2f59563c6f87b6370359c92f9e1a91553445beb1cea7b9b45faae932955bf339f20e78975a1973e2069be49d9baaeae2db3ca7f62b621e926934ad375bb007bcd3d730f2db632641543e3cf76c094b6b63d51d3ad15f0d6abdb0876857f1392ebb7f77055adf8e76a5f2ed3700134ca8cb6c8fb81ab1465a8d8a8408012de334609ae5cba45aedd7412f4228d5192272feaca2203cef7fd0f1d2ae5f62e0d9095e6aff6b6980bc3aef62cfa84ce89731f6d2373e2f5f72d15fc79c35303768d447f55fae6876ea84c49f17e399409f1e78f90847fcfacf960ff3ae7fa9f256b0f4ca7afbe720a140894af7ff26805edfdbe3d73c7a2b9aec3156a555249439c9e5ccc54b830dd5080e96a43c724809bec7372a6386cc4debc700a0a398b63671c0a89411c823a59a5430a0456ecce84886e308b86cd7b83bc5149d1485edfdea15961c11fffec8109ae20288679e87692f998f472507799511d1b77f64cdc45d1c6307e293cecacc800cf3cbb99b3510bfda94057782392d42d1fce030bc707af64fcdba03584e5610365e7987ab229dc6e74e286fc28c8bce82b6574423c98cc824cd8664b78b617cf363805b98564464c01efa3d928d212c14a525230bd626178d249999b0af2069a138f2a5a9689d02065365afc6d871a225eada0443514f87b208fed962731f42078e7f87b37e629309794e17314a1de9fe36e58b91f9a783a894238df12516e3034453b259268d88db1b9e801c215e91c544c50ed4380b621d91c157b11a9b9b44de42e8e9b3a7a6f704e8ff487ca542c4da926140e104a2592b4f9341cf747121afa7cb4851cfff10dac55ee05fe6d2e66b6cb777d8a6c285d5eededb3e8cfeeb01458"}, 0xffffffffffffffbc, 0xfff}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000040)=""/52) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7ba) (async)
syz_open_dev$vcsa(&(0x7f0000000780), 0x5, 0x82) (async)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f00000007c0)={0xff, 0xc9, 0x3, 0x2fd, 0x401, 0x9}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$tipc(r1, &(0x7f0000000740)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x1}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="009a0584816a6ac674a06a69350f2e8385cabcdad4b4b722f656f32a216fa573eff2bc931f123e5b552e693f1eebd9733ad251", 0x33}, {&(0x7f00000005c0)="041cf164bd7d2665482fbbe8dd72042e6774c72d2fd53134ddbc3cb0c117ba6b3334f43a5b248c583993948c90891e6c4136a7a1870ffc8101f4db80be5b7e2307d523cb21ec9d6e56f913d5c066f050c6f7c8df4aefb3d02c15ddfb2a94942ab93ae82d7700aa39a4f2e63432905221c9c95f1c5286e5d81d51fab4a383262150d3969f5c1a70d0f2a32d8f54909d76a57ab45ef89bff1f70d537108a75", 0x9e}, {&(0x7f0000000680)="8afb32602115c6", 0x7}], 0x3, &(0x7f0000000700)="fc0c441aae8fd318e84306d236d987a1a3c33e369ff52f68fc5097fdef72bf40d7d46a6cd27b7cf395ef40c3e41d799737e96d9798e1c0", 0x37, 0x810}, 0x40040) (async)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, 0x0, 0x0)

04:21:19 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf}, 0x0)

04:21:19 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x40, 0xff])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x40, 0xff]) (async)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, &(0x7f0000000100)="791c6ae7ca46fff47c1ce8b1ae88c44e2f1049fec3268c05f8b44c4021ab272339665efafbfe5e861effb84d83678c04a5a1c9b3b8125e2ef23ea991e11b5920555cfefdefcac495b9daedd7234210d24c80231f669de0dd86100736729b39111e5960f997085d933b48147d112999f6db7287f3be2ea1b869c3316d00c8ef160c6f774729c6afcefcd7e264b19d818047f0ea7319afcb9c67a28e24f9c0462fec217f7d39506f1aba96e03e4ff5d1a934e2f0d1aafb6105db3115d106b435a8d0c899890d88df263d2909a7f138da791d2a2800fd0c484dff08eff76ffa6249b2ebf2d4a747e3c2c4a9", 0xea, 0x4000810, 0x0, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffd}, 0x20)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40090}, 0x24000895)

04:21:19 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x402)
ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000100)=""/210)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x3])
setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000040)=0x9, 0x4)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x300}, 0x0)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x60}, 0x0)

04:21:19 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/194)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, &(0x7f0000000100)="791c6ae7ca46fff47c1ce8b1ae88c44e2f1049fec3268c05f8b44c4021ab272339665efafbfe5e861effb84d83678c04a5a1c9b3b8125e2ef23ea991e11b5920555cfefdefcac495b9daedd7234210d24c80231f669de0dd86100736729b39111e5960f997085d933b48147d112999f6db7287f3be2ea1b869c3316d00c8ef160c6f774729c6afcefcd7e264b19d818047f0ea7319afcb9c67a28e24f9c0462fec217f7d39506f1aba96e03e4ff5d1a934e2f0d1aafb6105db3115d106b435a8d0c899890d88df263d2909a7f138da791d2a2800fd0c484dff08eff76ffa6249b2ebf2d4a747e3c2c4a9", 0xea, 0x4000810, 0x0, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffd}, 0x20)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40090}, 0x24000895)

04:21:19 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:19 executing program 3:
write$P9_RWALK(0xffffffffffffffff, &(0x7f00000001c0)={0x30, 0x6f, 0x1, {0x3, [{0x80, 0x4, 0x3}, {0x40}, {0x8, 0x4}]}}, 0x30)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000200)=""/4096)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000001240)={0x9, 0xffff8001, 0x1, 0x0, 0x5, 0xfffff1e5})
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000180)={0x9, 0x1, 0x8, 0xf8, 0x1, 0xb})
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r4, 0x7aa, &(0x7f0000001280)={{@hyper, 0x7}, 0x0, 0xfffff800})
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000040)={0x55, 0x46, 0x8, {0x8, 0x4}, {0x0, 0x2}, @period={0x5d, 0x0, 0x200, 0xb3, 0x3ff, {0x8001, 0x2, 0x33}, 0x5, &(0x7f0000000100)=[0xf722, 0x7, 0x4, 0x1, 0x100]}})
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000001200)={@hyper, 0x1ff})

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x300}, 0x0)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf0}, 0x0)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, &(0x7f0000000100)="791c6ae7ca46fff47c1ce8b1ae88c44e2f1049fec3268c05f8b44c4021ab272339665efafbfe5e861effb84d83678c04a5a1c9b3b8125e2ef23ea991e11b5920555cfefdefcac495b9daedd7234210d24c80231f669de0dd86100736729b39111e5960f997085d933b48147d112999f6db7287f3be2ea1b869c3316d00c8ef160c6f774729c6afcefcd7e264b19d818047f0ea7319afcb9c67a28e24f9c0462fec217f7d39506f1aba96e03e4ff5d1a934e2f0d1aafb6105db3115d106b435a8d0c899890d88df263d2909a7f138da791d2a2800fd0c484dff08eff76ffa6249b2ebf2d4a747e3c2c4a9", 0xea, 0x4000810, 0x0, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffd}, 0x20)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40090}, 0x24000895)

04:21:19 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/194)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/194) (async)

04:21:19 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x300}, 0x0)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x300}, 0x0)

04:21:19 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/194)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000100)=""/194) (async)

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1000, @private1, 0x9}, 0x20)

04:21:19 executing program 3:
write$P9_RWALK(0xffffffffffffffff, &(0x7f00000001c0)={0x30, 0x6f, 0x1, {0x3, [{0x80, 0x4, 0x3}, {0x40}, {0x8, 0x4}]}}, 0x30) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000200)=""/4096) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000001240)={0x9, 0xffff8001, 0x1, 0x0, 0x5, 0xfffff1e5}) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000180)={0x9, 0x1, 0x8, 0xf8, 0x1, 0xb}) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r4, 0x7aa, &(0x7f0000001280)={{@hyper, 0x7}, 0x0, 0xfffff800}) (async)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000040)={0x55, 0x46, 0x8, {0x8, 0x4}, {0x0, 0x2}, @period={0x5d, 0x0, 0x200, 0xb3, 0x3ff, {0x8001, 0x2, 0x33}, 0x5, &(0x7f0000000100)=[0xf722, 0x7, 0x4, 0x1, 0x100]}})
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000001200)={@hyper, 0x1ff})

04:21:19 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x6, 0x200)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r1, 0x7af, &(0x7f0000000140)={@hyper, 0x3117})
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x8, 0x0, 0x80, 0x1, 0x2, 0xffff91c3})
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000080)=""/152)

04:21:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x700}, 0x0)

04:21:19 executing program 3:
write$P9_RWALK(0xffffffffffffffff, &(0x7f00000001c0)={0x30, 0x6f, 0x1, {0x3, [{0x80, 0x4, 0x3}, {0x40}, {0x8, 0x4}]}}, 0x30) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000200)=""/4096) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000001240)={0x9, 0xffff8001, 0x1, 0x0, 0x5, 0xfffff1e5}) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80) (async)
pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000180)={0x9, 0x1, 0x8, 0xf8, 0x1, 0xb})
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$IOCTL_VMCI_QUEUEPAIR_DETACH(r4, 0x7aa, &(0x7f0000001280)={{@hyper, 0x7}, 0x0, 0xfffff800}) (async)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000040)={0x55, 0x46, 0x8, {0x8, 0x4}, {0x0, 0x2}, @period={0x5d, 0x0, 0x200, 0xb3, 0x3ff, {0x8001, 0x2, 0x33}, 0x5, &(0x7f0000000100)=[0xf722, 0x7, 0x4, 0x1, 0x100]}}) (async)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000001200)={@hyper, 0x1ff})

04:21:19 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x341)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/86)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x24, 0x7])

04:21:19 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1000, @private1, 0x9}, 0x20)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xe00}, 0x0)

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x6, 0x200)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r1, 0x7af, &(0x7f0000000140)={@hyper, 0x3117}) (async)
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x8, 0x0, 0x80, 0x1, 0x2, 0xffff91c3})
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000080)=""/152)

04:21:20 executing program 2:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1000, @private1, 0x9}, 0x20)

04:21:20 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x341)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/86)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x24, 0x7])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x341) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/86) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x24, 0x7]) (async)

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1005, 0x4882c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000040)={0x17, 0xf0, &(0x7f00000000c0)="5cc7d65cf22c1b934818dfb68d12c8d6eaa72152982de10f3c1e578bed88852856d7189316faa3f8b311ab33195db91ce0837e6c205eeb7f8da1c4783e0833a08fa5b56462b6c40c15b082cfe2c04ce6cfbced20c54ba6d0c88dc3322a01608d4f0876fb82483b66781ad8d7ed6692fe5a5ea56b2de909c98805b138578ec9ca019e3098074b327065c4a67e55892637969e4ac2244a213d5c253519b2cf39ef733ebfdb44db0ae94909eafc32075f23bcd93ce899d87bea3e97754106533f21efcfd95f9ed1e243b6e68c1b8f49c7bd5d5ce9ecc0ea09284fb3a6f1c14d1ade44ead5d98225501b32fc6b5fddaa97eb"})
r2 = syz_open_dev$vcsa(&(0x7f00000003c0), 0x0, 0x200200)
r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
r4 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x80, 0x0, &(0x7f0000000600)=[@free_buffer={0x40086303, r3}, @acquire_done={0x40106309, 0x1}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/242, 0xf2, 0x1, 0x31}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x100, 0x3}}, &(0x7f0000000580)={0x0, 0x28, 0x40}}}, @increfs, @enter_looper, @register_looper, @free_buffer={0x40086303, r4}], 0x0, 0x0, &(0x7f0000000680)})
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
ioctl$EVIOCGSW(r5, 0x8040451b, &(0x7f00000001c0)=""/242)
pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEY(r6, 0x80404518, &(0x7f0000000700)=""/228)
ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, &(0x7f00000002c0)=""/235)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf00}, 0x0)

04:21:20 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x6, 0x200)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r1, 0x7af, &(0x7f0000000140)={@hyper, 0x3117})
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x8, 0x0, 0x80, 0x1, 0x2, 0xffff91c3})
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000080)=""/152)
syz_open_dev$evdev(&(0x7f0000000040), 0x6, 0x200) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r1, 0x7af, &(0x7f0000000140)={@hyper, 0x3117}) (async)
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x8, 0x0, 0x80, 0x1, 0x2, 0xffff91c3}) (async)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000080)=""/152) (async)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1000, @private1, 0x9}, 0x20)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10a04206}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2d}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$l2tp6(0xa, 0x2, 0x73)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000140)={r3, 0x5})
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCSABS2F(r3, 0x401845ef, &(0x7f0000000180)={0xffffffe0, 0x4, 0x80000000, 0x80000000, 0x6, 0x10000})

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1005, 0x4882c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000040)={0x17, 0xf0, &(0x7f00000000c0)="5cc7d65cf22c1b934818dfb68d12c8d6eaa72152982de10f3c1e578bed88852856d7189316faa3f8b311ab33195db91ce0837e6c205eeb7f8da1c4783e0833a08fa5b56462b6c40c15b082cfe2c04ce6cfbced20c54ba6d0c88dc3322a01608d4f0876fb82483b66781ad8d7ed6692fe5a5ea56b2de909c98805b138578ec9ca019e3098074b327065c4a67e55892637969e4ac2244a213d5c253519b2cf39ef733ebfdb44db0ae94909eafc32075f23bcd93ce899d87bea3e97754106533f21efcfd95f9ed1e243b6e68c1b8f49c7bd5d5ce9ecc0ea09284fb3a6f1c14d1ade44ead5d98225501b32fc6b5fddaa97eb"}) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000003c0), 0x0, 0x200200) (async)
r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) (async)
r4 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x80, 0x0, &(0x7f0000000600)=[@free_buffer={0x40086303, r3}, @acquire_done={0x40106309, 0x1}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/242, 0xf2, 0x1, 0x31}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x100, 0x3}}, &(0x7f0000000580)={0x0, 0x28, 0x40}}}, @increfs, @enter_looper, @register_looper, @free_buffer={0x40086303, r4}], 0x0, 0x0, &(0x7f0000000680)})
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5) (async)
ioctl$EVIOCGSW(r5, 0x8040451b, &(0x7f00000001c0)=""/242) (async)
pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEY(r6, 0x80404518, &(0x7f0000000700)=""/228)
ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, &(0x7f00000002c0)=""/235)

04:21:20 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x341)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/86)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x24, 0x7])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x341) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000040)=""/86) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x24, 0x7]) (async)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x393e}, 0x0)

04:21:20 executing program 2:
syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x10c80)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x800)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000000c0)=""/7)
syz_open_dev$vcsa(&(0x7f0000000080), 0x1000, 0x101080)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0)
ioctl$EVIOCSREP(r1, 0x541b, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="3700045c5c4f0009004dc24d"], 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x400, 0x70bd25, 0xfff}, 0x14}, 0x1, 0x0, 0x0, 0x20008050}, 0x4004001)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
bind$l2tp6(r2, &(0x7f0000000140)={0xa, 0x0, 0x7ff, @mcast1, 0x1}, 0x20)
write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="230000006f0100020080010000000700"/35], 0x23)

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x10000, 0x4, 0x3, 0x4, 0x2, 0x5})

04:21:20 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/4096)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x8, 0x401])

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10a04206}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2d}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000140)={r3, 0x5})
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCSABS2F(r3, 0x401845ef, &(0x7f0000000180)={0xffffffe0, 0x4, 0x80000000, 0x80000000, 0x6, 0x10000})

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x3e39}, 0x0)

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1005, 0x4882c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000040)={0x17, 0xf0, &(0x7f00000000c0)="5cc7d65cf22c1b934818dfb68d12c8d6eaa72152982de10f3c1e578bed88852856d7189316faa3f8b311ab33195db91ce0837e6c205eeb7f8da1c4783e0833a08fa5b56462b6c40c15b082cfe2c04ce6cfbced20c54ba6d0c88dc3322a01608d4f0876fb82483b66781ad8d7ed6692fe5a5ea56b2de909c98805b138578ec9ca019e3098074b327065c4a67e55892637969e4ac2244a213d5c253519b2cf39ef733ebfdb44db0ae94909eafc32075f23bcd93ce899d87bea3e97754106533f21efcfd95f9ed1e243b6e68c1b8f49c7bd5d5ce9ecc0ea09284fb3a6f1c14d1ade44ead5d98225501b32fc6b5fddaa97eb"}) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000003c0), 0x0, 0x200200)
r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) (async)
r4 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x80, 0x0, &(0x7f0000000600)=[@free_buffer={0x40086303, r3}, @acquire_done={0x40106309, 0x1}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/242, 0xf2, 0x1, 0x31}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x100, 0x3}}, &(0x7f0000000580)={0x0, 0x28, 0x40}}}, @increfs, @enter_looper, @register_looper, @free_buffer={0x40086303, r4}], 0x0, 0x0, &(0x7f0000000680)})
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5) (async)
ioctl$EVIOCGSW(r5, 0x8040451b, &(0x7f00000001c0)=""/242) (async)
pipe2$watch_queue(&(0x7f0000000680)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEY(r6, 0x80404518, &(0x7f0000000700)=""/228) (async)
ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, &(0x7f00000002c0)=""/235)

04:21:20 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/4096) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x8, 0x401])

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x10000, 0x4, 0x3, 0x4, 0x2, 0x5})

04:21:20 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x10, 0x0)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x6000}, 0x0)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10a04206}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2d}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000140)={r3, 0x5}) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCSABS2F(r3, 0x401845ef, &(0x7f0000000180)={0xffffffe0, 0x4, 0x80000000, 0x80000000, 0x6, 0x10000})

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000100)=""/123)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x3, 0x4}, 0x7}}, 0x18)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x10000, 0x4, 0x3, 0x4, 0x2, 0x5})

04:21:20 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 64)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/4096) (rerun: 64)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x8, 0x401])

04:21:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x4}, 0x14}}, 0x0)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf000}, 0x0)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000100)=""/123)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x3, 0x4}, 0x7}}, 0x18)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x501840)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x6, 0x1a, 0x5, 0x5, "f2da72eb2d571e419714fdd84e9d8948531a3ed1a688490a5aca7521aae6c9c1"})
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000100)=""/212)

04:21:20 executing program 2:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0xfffffffd}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040010}, 0x8000)
ioctl$X86_IOC_RDMSR_REGS(r1, 0xc02063a0, &(0x7f0000000000)=[0xad, 0x7fdf, 0x400, 0x200, 0x4, 0x1, 0x7, 0xd9e4])
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
bind$l2tp6(r4, &(0x7f0000000080)={0xa, 0x0, 0x8, @loopback, 0x1, 0x4}, 0x20)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
bind$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0x8, @private1, 0x2, 0x3}, 0x20)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:20 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x200)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x800, 0x1])
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf0ffff}, 0x0)

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x501840)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x6, 0x1a, 0x5, 0x5, "f2da72eb2d571e419714fdd84e9d8948531a3ed1a688490a5aca7521aae6c9c1"})
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000100)=""/212)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x501840) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x6, 0x1a, 0x5, 0x5, "f2da72eb2d571e419714fdd84e9d8948531a3ed1a688490a5aca7521aae6c9c1"}) (async)
pipe2$watch_queue(&(0x7f0000000080), 0x80) (async)
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000100)=""/212) (async)

04:21:20 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000100)=""/123)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x3, 0x4}, 0x7}}, 0x18) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0) (fail_nth: 1)

04:21:20 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x200)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x800, 0x1])
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x200) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x800, 0x1]) (async)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0) (async)

04:21:20 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x1000000}, 0x0)

04:21:20 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:20 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x501840)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x6, 0x1a, 0x5, 0x5, "f2da72eb2d571e419714fdd84e9d8948531a3ed1a688490a5aca7521aae6c9c1"}) (async)
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000100)=""/212)

04:21:20 executing program 3:
write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0) (fail_nth: 2)

04:21:21 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x200)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)=[0x800, 0x1]) (async)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0)

[ 3525.302353][T28150] FAULT_INJECTION: forcing a failure.
[ 3525.302353][T28150] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 3525.302389][T28150] CPU: 1 PID: 28150 Comm: syz-executor.2 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x2000000}, 0x0)

04:21:21 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

[ 3525.302418][T28150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3525.302434][T28150] Call Trace:
04:21:21 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:21 executing program 3:
write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0) (fail_nth: 3)

[ 3525.302440][T28150]  <TASK>
[ 3525.302450][T28150]  dump_stack_lvl+0xcd/0x134
04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{@fixed}, {@fixed}, {@none}]})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x135c, 0x3, 0x5, 0x6, 0x9, 0x4})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x24, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x60}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4040030)

04:21:21 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)

04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x3000000}, 0x0)

[ 3525.302484][T28150]  should_fail.cold+0x5/0xa
[ 3525.302530][T28150]  _copy_from_user+0x2a/0x170
04:21:21 executing program 3:
write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:21 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 64)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (rerun: 64)

[ 3525.302559][T28150]  __copy_msghdr_from_user+0x91/0x4b0
[ 3525.302589][T28150]  ? __ia32_sys_shutdown+0x70/0x70
04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x4000000}, 0x0)

04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0) (fail_nth: 4)

04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{@fixed}, {@fixed}, {@none}]})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x135c, 0x3, 0x5, 0x6, 0x9, 0x4})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x24, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x60}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4040030)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{@fixed}, {@fixed}, {@none}]}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x135c, 0x3, 0x5, 0x6, 0x9, 0x4}) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x24, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x60}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4040030) (async)

04:21:21 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

[ 3525.302625][T28150]  ? __lock_acquire+0xbca/0x5660
[ 3525.302675][T28150]  sendmsg_copy_msghdr+0xa1/0x160
04:21:21 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x305001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

[ 3525.302707][T28150]  ? do_recvmmsg+0x6d0/0x6d0
[ 3525.302733][T28150]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3525.302776][T28150]  ? _parse_integer+0x30/0x30
04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.302816][T28150]  ___sys_sendmsg+0xc6/0x170
04:21:21 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x8200)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000040)=[0x80000000, 0x3])
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x0, 0xbdd])
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x7000000}, 0x0)

04:21:21 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x305001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

[ 3525.302852][T28150]  ? sendmsg_copy_msghdr+0x160/0x160
[ 3525.302883][T28150]  ? __fget_files+0x264/0x470
04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000280)={0x3, &(0x7f0000000240)=[{@fixed}, {@fixed}, {@none}]}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x135c, 0x3, 0x5, 0x6, 0x9, 0x4}) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
openat$vimc0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x24, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x60}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4040030)

04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.302918][T28150]  ? lock_downgrade+0x6e0/0x6e0
[ 3525.302974][T28150]  ? __fget_files+0x286/0x470
[ 3525.303020][T28150]  ? __fget_light+0xea/0x270
04:21:21 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x0, 0x9, 0x2e70, 0x4a, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:21 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x8200) (async)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000040)=[0x80000000, 0x3])
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x0, 0xbdd])
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x8000000}, 0x0)

04:21:21 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x305001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x305001) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

[ 3525.303054][T28150]  ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 3525.303093][T28150]  __x64_sys_sendmsg+0x132/0x220
[ 3525.303117][T28150]  ? __sys_sendmsg+0x1b0/0x1b0
[ 3525.303157][T28150]  ? syscall_enter_from_user_mode+0x21/0x70
04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x2, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x412800)

04:21:21 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x8200)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000040)=[0x80000000, 0x3])
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x0, 0xbdd])
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x8200) (async)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000040)=[0x80000000, 0x3]) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x0, 0xbdd]) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

[ 3525.303201][T28150]  do_syscall_64+0x35/0xb0
04:21:21 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x0, 0x9, 0x2e70, 0x4a, 0x8, 0x1}) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xe000000}, 0x0)

[ 3525.303227][T28150]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3525.303252][T28150] RIP: 0033:0x7fa51a6890e9
04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x4, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:21 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x200000000000083, 0x30003)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000080)={0x408, r1}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x400000])
syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r1)

04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 64)
syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x412800) (rerun: 64)

[ 3525.303270][T28150] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:21 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff9, 0x4980)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffff9, 0x40)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:21 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf000000}, 0x0)

04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x7, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:21 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x0, 0x9, 0x2e70, 0x4a, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x0, 0x9, 0x2e70, 0x4a, 0x8, 0x1}) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

[ 3525.303291][T28150] RSP: 002b:00007fa51b7bf168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 3525.303312][T28150] RAX: ffffffffffffffda RBX: 00007fa51a79bf60 RCX: 00007fa51a6890e9
04:21:21 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x200000000000083, 0x30003)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000080)={0x408, r1}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x400000])
syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r1)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f0000000040), 0x200000000000083, 0x30003) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000080)={0x408, r1}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x400000]) (async)
syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r1) (async)

04:21:21 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 32)
syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x412800) (rerun: 32)

[ 3525.303328][T28150] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000003
[ 3525.303341][T28150] RBP: 00007fa51b7bf1d0 R08: 0000000000000000 R09: 0000000000000000
04:21:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x10, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.303356][T28150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3525.303369][T28150] R13: 00007fffba1d5b8f R14: 00007fa51b7bf300 R15: 0000000000022000
[ 3525.303397][T28150]  </TASK>
04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x3e390000}, 0x0)

04:21:22 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/236)
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0xfffffffff8dbe6ea, 0x1010c0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000280)={0x1, 0x100, 0x1, 0x10001, 0x5, 0x9})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000180)=""/56)
getpeername$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, &(0x7f0000000140)=0x20)
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/184, 0xb8, 0x40000040, 0x0, 0x0)
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x0)
pipe2$9p(&(0x7f00000001c0), 0x84000)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:22 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x200000000000083, 0x30003)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000080)={0x408, r1}, 0x0) (async, rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async, rerun: 32)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x400000])
syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r1)

04:21:22 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000040)=[0xc26f, 0x7fffffff])

04:21:22 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff9, 0x4980)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffff9, 0x40)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff9, 0x4980) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffff9, 0x40) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

[ 3525.595584][T28186] FAULT_INJECTION: forcing a failure.
[ 3525.595584][T28186] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x60000000}, 0x0)

04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x700, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.595620][T28186] CPU: 1 PID: 28186 Comm: syz-executor.2 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:22 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff9, 0x4980)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffff9, 0x40)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff9, 0x4980) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffff9, 0x40) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:22 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/236) (async)
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0xfffffffff8dbe6ea, 0x1010c0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000280)={0x1, 0x100, 0x1, 0x10001, 0x5, 0x9}) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000180)=""/56)
getpeername$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, &(0x7f0000000140)=0x20) (async)
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/184, 0xb8, 0x40000040, 0x0, 0x0) (async, rerun: 64)
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x0) (async, rerun: 64)
pipe2$9p(&(0x7f00000001c0), 0x84000) (async)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:22 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000040)=[0xc26f, 0x7fffffff])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000040)=[0xc26f, 0x7fffffff]) (async)

[ 3525.595649][T28186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3525.595664][T28186] Call Trace:
04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x9effffff}, 0x0)

[ 3525.595670][T28186]  <TASK>
[ 3525.595679][T28186]  dump_stack_lvl+0xcd/0x134
[ 3525.595716][T28186]  should_fail.cold+0x5/0xa
04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0xf0ff7f, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:22 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x5052c2)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/107)

[ 3525.595762][T28186]  _copy_from_user+0x2a/0x170
[ 3525.595790][T28186]  iovec_from_user+0x149/0x3a0
04:21:22 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3f, 0x40000)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x4, 0x4, 0x101, 0x15, "bec8fbb79aabd844d9f585a1917aac9dedf5fc3fb5ddbd638284551af6717b5c"})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x7, 0x4, 0x42bc, 0xb81, "c7836081fdca1feaff7a57a5d3b612341fe83f1938919596b866176c51c0c059"})

04:21:22 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/236)
r0 = syz_open_dev$evdev(&(0x7f0000000200), 0xfffffffff8dbe6ea, 0x1010c0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000280)={0x1, 0x100, 0x1, 0x10001, 0x5, 0x9}) (async, rerun: 64)
r1 = socket$l2tp6(0xa, 0x2, 0x73) (async, rerun: 64)
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000180)=""/56)
getpeername$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, &(0x7f0000000140)=0x20) (async, rerun: 64)
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/184, 0xb8, 0x40000040, 0x0, 0x0) (async, rerun: 64)
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x0) (async)
pipe2$9p(&(0x7f00000001c0), 0x84000)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:22 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000040)=[0xc26f, 0x7fffffff])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000040)=[0xc26f, 0x7fffffff]) (async)

[ 3525.595833][T28186]  ? _copy_from_user+0xf9/0x170
[ 3525.595864][T28186]  __import_iovec+0x65/0x5d0
[ 3525.595911][T28186]  import_iovec+0x10c/0x150
[ 3525.595950][T28186]  sendmsg_copy_msghdr+0x12d/0x160
04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf0ffffff}, 0x0)

04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x1000000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.595978][T28186]  ? do_recvmmsg+0x6d0/0x6d0
[ 3525.596004][T28186]  ? lockdep_hardirqs_on_prepare+0x400/0x400
04:21:22 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x5052c2)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/107)

04:21:22 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
syz_open_dev$vcsa(&(0x7f0000000040), 0x101, 0x108100)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r4)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/210)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

[ 3525.596046][T28186]  ? _parse_integer+0x30/0x30
[ 3525.596083][T28186]  ___sys_sendmsg+0xc6/0x170
[ 3525.596110][T28186]  ? sendmsg_copy_msghdr+0x160/0x160
[ 3525.596141][T28186]  ? __fget_files+0x264/0x470
04:21:22 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3f, 0x40000)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x4, 0x4, 0x101, 0x15, "bec8fbb79aabd844d9f585a1917aac9dedf5fc3fb5ddbd638284551af6717b5c"})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x7, 0x4, 0x42bc, 0xb81, "c7836081fdca1feaff7a57a5d3b612341fe83f1938919596b866176c51c0c059"})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000040), 0x3f, 0x40000) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x4, 0x4, 0x101, 0x15, "bec8fbb79aabd844d9f585a1917aac9dedf5fc3fb5ddbd638284551af6717b5c"}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x7, 0x4, 0x42bc, 0xb81, "c7836081fdca1feaff7a57a5d3b612341fe83f1938919596b866176c51c0c059"}) (async)

04:21:22 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x599, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3, 0x1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

[ 3525.596172][T28186]  ? lock_downgrade+0x6e0/0x6e0
04:21:22 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x5052c2)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/107)

04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xfffff000}, 0x0)

04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x2000000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

[ 3525.596221][T28186]  ? __fget_files+0x286/0x470
[ 3525.596263][T28186]  ? __fget_light+0xea/0x270
04:21:22 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
syz_open_dev$vcsa(&(0x7f0000000040), 0x101, 0x108100)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r4) (async)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/210) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:22 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x599, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3, 0x1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

[ 3525.596297][T28186]  ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 3525.596332][T28186]  __x64_sys_sendmsg+0x132/0x220
[ 3525.596357][T28186]  ? __sys_sendmsg+0x1b0/0x1b0
04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x4000000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:22 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xffffff7f}, 0x0)

[ 3525.596399][T28186]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3525.596445][T28186]  do_syscall_64+0x35/0xb0
04:21:22 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x3f, 0x40000)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000100)={0x4, 0x4, 0x101, 0x15, "bec8fbb79aabd844d9f585a1917aac9dedf5fc3fb5ddbd638284551af6717b5c"})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x7, 0x4, 0x42bc, 0xb81, "c7836081fdca1feaff7a57a5d3b612341fe83f1938919596b866176c51c0c059"})

04:21:22 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
bind$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x599, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3, 0x1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

[ 3525.596477][T28186]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3525.596503][T28186] RIP: 0033:0x7fa51a6890e9
04:21:22 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x7000000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:22 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
syz_open_dev$vcsa(&(0x7f0000000040), 0x101, 0x108100) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r4) (async)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/210) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:22 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x3421ec04, 0x8001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2000001])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0)
write$P9_RAUTH(r1, &(0x7f00000007c0)={0x14, 0x67, 0x1, {0x80, 0x1, 0x7}}, 0x14)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000340)={@none, 0x6, 0x7, 0x1000})
write$P9_RWSTAT(r0, &(0x7f0000000380)={0x7, 0x7f, 0x2}, 0x7)
ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000800)=""/166)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
clock_gettime(0x0, &(0x7f00000008c0)={<r5=>0x0, <r6=>0x0})
write$evdev(r4, &(0x7f0000000900)=[{{0x77359400}, 0x11, 0x9, 0x775}, {{r5, r6/1000+60000}, 0x17, 0x9, 0x1}], 0x30)
sendmsg$tipc(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="ff45430edb3d7fe75b7b6c5dae9d10f104eff88cc9f34f6d0563e1a85cb00501252f19c4ebf5dc27ccacc4bab75e90aa24ca47da83bd5327622ba741648fb725885a4d2dbf9ea0cffa0431bc7647addbac267b1561aef4b6c7b0", 0x5a}, {&(0x7f0000000440)="e0812aade4662edaef587e543eceee0c22f7a3aac5ee7122389f1d4fdefd27bc74e45dd6ca323f8d2260430c725a02aa98e33f902104c0e72d1d1e47b089a5ba0c3f30db7b37ff8b2a2c55643001e9735ffa8d24f351e75c068af3fd32003812dc3b812cdfbef889bebe62612cdc4ea11281f62f34233f496c6561694bf6a3757a9a2f877bce0e", 0x87}, {&(0x7f0000000500)="535104b7bdc4fb49a78d8e00551dd2f082382cd8ceff7a7a81878183d142675afe3ecfba892cae52580151a2cfee9aeb2a01b7994961678150f3fdf2f6f2c51fb25910bec9729524e4f55022b6b6423ad2", 0x51}, {&(0x7f0000000600)="3128ce7c372ec9697733b92f4dda8ba6bd70cb85e00d8226b53f9c229b918ef25651431904ab3e6d73adb9eedbebf3f3da3640f672ad2add1548a7237946375a4683f74c8179669031762866e76577e750f4b45a6002997d3073f7599ad87854806f0aed7e0c335951b45cbeb12ad27f6e74f28dc26dcfad80d0f633b8dff76b13004e56408ee3c5bf2c588dadb67e343d414ef7d846582b7bc2b60d2d858094c18683c203bbc6130ff6155f2267dc06b245bab6919c3106111f4a1ee5888f9e5e4627e4ab2168dd2fef0e3c429af0357e592da7797ed5ead4e44f2d11fabd1ae5434043e6d6fada701ba7560af887680364e8b4f34561f4cb0a0d", 0xfb}], 0x4, &(0x7f0000000700)="7e1810763e00daccfbdba14d17f6af79c91508b7b6eb7bf11545564a08ba5784b4a2ecd5268425519101f2be847e16feeca1f361351ef3a4cb3766fc26f43ecc9b4f8b3c421ba1c7eec80a24ceef260af111a414a2714bc04114eeca", 0x5c, 0x800}, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0x58, r2, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffffff}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x48840}, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00042dbd7019835200fddbdf2589e6080000000000000000000500370001000000050029000100000005002e000101000008003a000100008008002b000100000005002f000100000008003b0006000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000090}, 0x800)

04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xffffff9e}, 0x0)

[ 3525.596523][T28186] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:22 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r3, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xb4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xc05}]}, 0x44}}, 0x4000011)
r5 = socket(0x0, 0x4, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'})
bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x7fff, @ipv4={'\x00', '\xff\xff', @remote}, 0x3f, 0x3}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0xc5490000, @local, 0x0, 0x1}, 0x20)

[ 3525.596548][T28186] RSP: 002b:00007fa51b7bf168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
04:21:22 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:22 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
bind$pptp(r1, &(0x7f0000001100)={0x18, 0x2, {0x2, @empty}}, 0x1e)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000100)=""/4096)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000040)=0x800)

04:21:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x10000000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xfffffff0}, 0x0)

[ 3525.596571][T28186] RAX: ffffffffffffffda RBX: 00007fa51a79bf60 RCX: 00007fa51a6890e9
[ 3525.596588][T28186] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000003
04:21:22 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x3421ec04, 0x8001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2000001]) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) (async)
write$P9_RAUTH(r1, &(0x7f00000007c0)={0x14, 0x67, 0x1, {0x80, 0x1, 0x7}}, 0x14) (async)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000340)={@none, 0x6, 0x7, 0x1000}) (async)
write$P9_RWSTAT(r0, &(0x7f0000000380)={0x7, 0x7f, 0x2}, 0x7)
ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000800)=""/166) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
clock_gettime(0x0, &(0x7f00000008c0)={<r5=>0x0, <r6=>0x0})
write$evdev(r4, &(0x7f0000000900)=[{{0x77359400}, 0x11, 0x9, 0x775}, {{r5, r6/1000+60000}, 0x17, 0x9, 0x1}], 0x30) (async, rerun: 64)
sendmsg$tipc(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="ff45430edb3d7fe75b7b6c5dae9d10f104eff88cc9f34f6d0563e1a85cb00501252f19c4ebf5dc27ccacc4bab75e90aa24ca47da83bd5327622ba741648fb725885a4d2dbf9ea0cffa0431bc7647addbac267b1561aef4b6c7b0", 0x5a}, {&(0x7f0000000440)="e0812aade4662edaef587e543eceee0c22f7a3aac5ee7122389f1d4fdefd27bc74e45dd6ca323f8d2260430c725a02aa98e33f902104c0e72d1d1e47b089a5ba0c3f30db7b37ff8b2a2c55643001e9735ffa8d24f351e75c068af3fd32003812dc3b812cdfbef889bebe62612cdc4ea11281f62f34233f496c6561694bf6a3757a9a2f877bce0e", 0x87}, {&(0x7f0000000500)="535104b7bdc4fb49a78d8e00551dd2f082382cd8ceff7a7a81878183d142675afe3ecfba892cae52580151a2cfee9aeb2a01b7994961678150f3fdf2f6f2c51fb25910bec9729524e4f55022b6b6423ad2", 0x51}, {&(0x7f0000000600)="3128ce7c372ec9697733b92f4dda8ba6bd70cb85e00d8226b53f9c229b918ef25651431904ab3e6d73adb9eedbebf3f3da3640f672ad2add1548a7237946375a4683f74c8179669031762866e76577e750f4b45a6002997d3073f7599ad87854806f0aed7e0c335951b45cbeb12ad27f6e74f28dc26dcfad80d0f633b8dff76b13004e56408ee3c5bf2c588dadb67e343d414ef7d846582b7bc2b60d2d858094c18683c203bbc6130ff6155f2267dc06b245bab6919c3106111f4a1ee5888f9e5e4627e4ab2168dd2fef0e3c429af0357e592da7797ed5ead4e44f2d11fabd1ae5434043e6d6fada701ba7560af887680364e8b4f34561f4cb0a0d", 0xfb}], 0x4, &(0x7f0000000700)="7e1810763e00daccfbdba14d17f6af79c91508b7b6eb7bf11545564a08ba5784b4a2ecd5268425519101f2be847e16feeca1f361351ef3a4cb3766fc26f43ecc9b4f8b3c421ba1c7eec80a24ceef260af111a414a2714bc04114eeca", 0x5c, 0x800}, 0x0) (async, rerun: 64)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0x58, r2, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffffff}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x48840}, 0x0) (async, rerun: 64)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00042dbd7019835200fddbdf2589e6080000000000000000000500370001000000050029000100000005002e000101000008003a000100008008002b000100000005002f000100000008003b0006000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000090}, 0x800) (rerun: 64)

[ 3525.596602][T28186] RBP: 00007fa51b7bf1d0 R08: 0000000000000000 R09: 0000000000000000
04:21:22 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0)

04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000000)={0x9, 0x3, 0x6, 0x5, 0x3, 0x80000001})

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x7ffff000, &(0x7f00000002c0)={0x0}, 0x300}, 0x0)

04:21:23 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
bind$pptp(r1, &(0x7f0000001100)={0x18, 0x2, {0x2, @empty}}, 0x1e) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000100)=""/4096) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000040)=0x800)

[ 3525.596618][T28186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3525.596633][T28186] R13: 00007fffba1d5b8f R14: 00007fa51b7bf300 R15: 0000000000022000
04:21:23 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x3421ec04, 0x8001)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2000001]) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) (async)
write$P9_RAUTH(r1, &(0x7f00000007c0)={0x14, 0x67, 0x1, {0x80, 0x1, 0x7}}, 0x14)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000340)={@none, 0x6, 0x7, 0x1000}) (async, rerun: 32)
write$P9_RWSTAT(r0, &(0x7f0000000380)={0x7, 0x7f, 0x2}, 0x7) (async, rerun: 32)
ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000800)=""/166) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 32)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async, rerun: 32)
clock_gettime(0x0, &(0x7f00000008c0)={<r5=>0x0, <r6=>0x0}) (rerun: 32)
write$evdev(r4, &(0x7f0000000900)=[{{0x77359400}, 0x11, 0x9, 0x775}, {{r5, r6/1000+60000}, 0x17, 0x9, 0x1}], 0x30) (async)
sendmsg$tipc(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="ff45430edb3d7fe75b7b6c5dae9d10f104eff88cc9f34f6d0563e1a85cb00501252f19c4ebf5dc27ccacc4bab75e90aa24ca47da83bd5327622ba741648fb725885a4d2dbf9ea0cffa0431bc7647addbac267b1561aef4b6c7b0", 0x5a}, {&(0x7f0000000440)="e0812aade4662edaef587e543eceee0c22f7a3aac5ee7122389f1d4fdefd27bc74e45dd6ca323f8d2260430c725a02aa98e33f902104c0e72d1d1e47b089a5ba0c3f30db7b37ff8b2a2c55643001e9735ffa8d24f351e75c068af3fd32003812dc3b812cdfbef889bebe62612cdc4ea11281f62f34233f496c6561694bf6a3757a9a2f877bce0e", 0x87}, {&(0x7f0000000500)="535104b7bdc4fb49a78d8e00551dd2f082382cd8ceff7a7a81878183d142675afe3ecfba892cae52580151a2cfee9aeb2a01b7994961678150f3fdf2f6f2c51fb25910bec9729524e4f55022b6b6423ad2", 0x51}, {&(0x7f0000000600)="3128ce7c372ec9697733b92f4dda8ba6bd70cb85e00d8226b53f9c229b918ef25651431904ab3e6d73adb9eedbebf3f3da3640f672ad2add1548a7237946375a4683f74c8179669031762866e76577e750f4b45a6002997d3073f7599ad87854806f0aed7e0c335951b45cbeb12ad27f6e74f28dc26dcfad80d0f633b8dff76b13004e56408ee3c5bf2c588dadb67e343d414ef7d846582b7bc2b60d2d858094c18683c203bbc6130ff6155f2267dc06b245bab6919c3106111f4a1ee5888f9e5e4627e4ab2168dd2fef0e3c429af0357e592da7797ed5ead4e44f2d11fabd1ae5434043e6d6fada701ba7560af887680364e8b4f34561f4cb0a0d", 0xfb}], 0x4, &(0x7f0000000700)="7e1810763e00daccfbdba14d17f6af79c91508b7b6eb7bf11545564a08ba5784b4a2ecd5268425519101f2be847e16feeca1f361351ef3a4cb3766fc26f43ecc9b4f8b3c421ba1c7eec80a24ceef260af111a414a2714bc04114eeca", 0x5c, 0x800}, 0x0) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)={0x58, r2, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffffff}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x48840}, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00042dbd7019835200fddbdf2589e6080000000000000000000500370001000000050029000100000005002e000101000008003a000100008008002b000100000005002f000100000008003b0006000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000090}, 0x800)

[ 3525.596668][T28186]  </TASK>
04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r3, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xb4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xc05}]}, 0x44}}, 0x4000011)
r5 = socket(0x0, 0x4, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) (async)
bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x7fff, @ipv4={'\x00', '\xff\xff', @remote}, 0x3f, 0x3}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0xc5490000, @local, 0x0, 0x1}, 0x20)

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x2}, 0x300}, 0x0)

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x100000000000000}, 0x0)

04:21:23 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
bind$pptp(r1, &(0x7f0000001100)={0x18, 0x2, {0x2, @empty}}, 0x1e)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000100)=""/4096)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000040)=0x800)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
bind$pptp(r1, &(0x7f0000001100)={0x18, 0x2, {0x2, @empty}}, 0x1e) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000100)=""/4096) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) (async)
ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000040)=0x800) (async)

04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000000)={0x9, 0x3, 0x6, 0x5, 0x3, 0x80000001})

[ 3525.718412][T28194] FAULT_INJECTION: forcing a failure.
[ 3525.718412][T28194] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 3525.718447][T28194] CPU: 1 PID: 28194 Comm: syz-executor.2 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
[ 3525.718475][T28194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x4}, 0x300}, 0x0)

04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async, rerun: 32)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async, rerun: 32)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r3, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xb4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xc05}]}, 0x44}}, 0x4000011) (async)
r5 = socket(0x0, 0x4, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) (async)
bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x7fff, @ipv4={'\x00', '\xff\xff', @remote}, 0x3f, 0x3}, 0x20) (async, rerun: 64)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0xc5490000, @local, 0x0, 0x1}, 0x20) (rerun: 64)

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x200000000000000}, 0x0)

[ 3525.718491][T28194] Call Trace:
[ 3525.718497][T28194]  <TASK>
[ 3525.718507][T28194]  dump_stack_lvl+0xcd/0x134
[ 3525.718543][T28194]  should_fail.cold+0x5/0xa
04:21:23 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x40000])

[ 3525.718592][T28194]  _copy_to_user+0x2a/0x140
04:21:23 executing program 4:
r0 = fanotify_init(0x8, 0x101000)
fanotify_mark(r0, 0x2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00')
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000000)={0x9, 0x3, 0x6, 0x5, 0x3, 0x80000001})

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x300000000000000}, 0x0)

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x7}, 0x300}, 0x0)

[ 3525.718619][T28194]  simple_read_from_buffer+0xcc/0x160
[ 3525.718664][T28194]  proc_fail_nth_read+0x187/0x220
[ 3525.718709][T28194]  ? proc_exe_link+0x1d0/0x1d0
[ 3525.718747][T28194]  ? security_file_permission+0xab/0xd0
[ 3525.718792][T28194]  ? proc_exe_link+0x1d0/0x1d0
[ 3525.718844][T28194]  vfs_read+0x1ef/0x5d0
[ 3525.718885][T28194]  ksys_read+0x127/0x250
04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x700, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:23 executing program 4:
r0 = fanotify_init(0x8, 0x101000)
fanotify_mark(r0, 0x2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00')
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
fanotify_init(0x8, 0x101000) (async)
fanotify_mark(r0, 0x2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00') (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)

04:21:23 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x40000])

[ 3525.718921][T28194]  ? vfs_write+0xac0/0xac0
[ 3525.718958][T28194]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3525.719004][T28194]  do_syscall_64+0x35/0xb0
04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x400000000000000}, 0x0)

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x10}, 0x300}, 0x0)

04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
getpeername$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

[ 3525.719034][T28194]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x700, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x700, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

[ 3525.719059][T28194] RIP: 0033:0x7fa51a63bc9c
[ 3525.719079][T28194] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
04:21:23 executing program 4:
r0 = fanotify_init(0x8, 0x101000)
fanotify_mark(r0, 0x2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00') (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x700}, 0x300}, 0x0)

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x700000000000000}, 0x0)

04:21:23 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x700, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x700, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
getpeername$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:23 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x40000])

[ 3525.719103][T28194] RSP: 002b:00007fa51b7bf160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
04:21:23 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000100)=""/194)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000200)=""/72)

04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0xf0ff7f}, 0x300}, 0x0)

[ 3525.719127][T28194] RAX: ffffffffffffffda RBX: 00007fa51a79bf60 RCX: 00007fa51a63bc9c
[ 3525.719145][T28194] RDX: 000000000000000f RSI: 00007fa51b7bf1e0 RDI: 0000000000000004
04:21:23 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x8)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x800000000000000}, 0x0)

[ 3525.719161][T28194] RBP: 00007fa51b7bf1d0 R08: 0000000000000000 R09: 0000000000000000
04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
getpeername$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:23 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x343)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0xb0, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/46, 0x2e, 0x0, 0x3e}, @fda={0x66646185, 0x6, 0x2, 0x1b}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}, 0x1000}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@binder={0x73622a85, 0x100, 0x1}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x2, 0x2, 0x4}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @acquire_done={0x40106309, 0x2}, @dead_binder_done], 0xea, 0x0, &(0x7f0000000300)="3fb64857759b3e050f627b620520b035e49ec086cbaa11cf909c7816aabb06089bfb84c13cf3295201b259b5b8e654ce2b544c13ae2891ebea9bd8eb70fa6d727cb628c426e7d044543b3fdce943a107306a169af59f1b55367b3170ab64541f058cba553a79416f3329c79f61dfc2f9989e7ad054290d1c6cdcfb5eccfa126112e214fef358f61ab3a234812a221c831fe633f434a08273d43357f9e56a8d8da2bb6ee9f6182d51dbe35c931f5829d70136acc6b2a7396e40e0c7d7da48cfc31c75a87c43d7d15b6b99dd9f11b54bfb2beaba279f9933ef19e49b0d46e581e10b60cce0ef4326772f71"})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)

04:21:23 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000100)=""/194)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000200)=""/72)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000100)=""/194) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000200)=""/72) (async)

[ 3525.719176][T28194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3525.719190][T28194] R13: 00007fffba1d5b8f R14: 00007fa51b7bf300 R15: 0000000000022000
04:21:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x1000000}, 0x300}, 0x0)

04:21:23 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xe00000000000000}, 0x0)

[ 3525.719225][T28194]  </TASK>
04:21:23 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x343) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0xb0, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/46, 0x2e, 0x0, 0x3e}, @fda={0x66646185, 0x6, 0x2, 0x1b}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}, 0x1000}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@binder={0x73622a85, 0x100, 0x1}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x2, 0x2, 0x4}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @acquire_done={0x40106309, 0x2}, @dead_binder_done], 0xea, 0x0, &(0x7f0000000300)="3fb64857759b3e050f627b620520b035e49ec086cbaa11cf909c7816aabb06089bfb84c13cf3295201b259b5b8e654ce2b544c13ae2891ebea9bd8eb70fa6d727cb628c426e7d044543b3fdce943a107306a169af59f1b55367b3170ab64541f058cba553a79416f3329c79f61dfc2f9989e7ad054290d1c6cdcfb5eccfa126112e214fef358f61ab3a234812a221c831fe633f434a08273d43357f9e56a8d8da2bb6ee9f6182d51dbe35c931f5829d70136acc6b2a7396e40e0c7d7da48cfc31c75a87c43d7d15b6b99dd9f11b54bfb2beaba279f9933ef19e49b0d46e581e10b60cce0ef4326772f71"}) (async)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)

04:21:23 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x8) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:23 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8008, &(0x7f0000000300)={0xa, 0x0, 0x400000, @mcast1, 0xffffffff}, 0xffffffffffffff7d)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x6, 0x20080)
r3 = socket$pptp(0x18, 0x1, 0x2)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000280))
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000002c0)={0x1100, r0}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1d}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}}, 0xf9583a81671795ce)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, &(0x7f0000000000)="a68b22c7fd80bf5c06301fead7317d341c6f43034edcdbddb7503a2be747ea1c320ea0e8bbf3e0a6007fce9aab8a10f54a65c16986859f51ea4ab0c113a19c1f8078d11144ea3d2b84055797916c5ee154a40083d648345a0bfbc091149e082225ff48662cf57f0161ab024ed04ad197242cb438b98eb64bfeeb77a8a90ac47bfab57e2747604a195bf48f2c2040ee312e0cd538860ed287360188fec0ac30a252895b462b7710579961317e30c0afc6fa564577ce3dc9c03564699a5668ce862fc9c39f7d558c9557e1eec46d4a455deacc2aa898286cf606", 0xd9, 0x4000000, 0x0, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000100)=""/194)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000200)=""/72)

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x2000000}, 0x300}, 0x0)

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf00000000000000}, 0x0)

04:21:24 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x343)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0xb0, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/46, 0x2e, 0x0, 0x3e}, @fda={0x66646185, 0x6, 0x2, 0x1b}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}, 0x1000}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@binder={0x73622a85, 0x100, 0x1}, @fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x2, 0x2, 0x4}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @acquire_done={0x40106309, 0x2}, @dead_binder_done], 0xea, 0x0, &(0x7f0000000300)="3fb64857759b3e050f627b620520b035e49ec086cbaa11cf909c7816aabb06089bfb84c13cf3295201b259b5b8e654ce2b544c13ae2891ebea9bd8eb70fa6d727cb628c426e7d044543b3fdce943a107306a169af59f1b55367b3170ab64541f058cba553a79416f3329c79f61dfc2f9989e7ad054290d1c6cdcfb5eccfa126112e214fef358f61ab3a234812a221c831fe633f434a08273d43357f9e56a8d8da2bb6ee9f6182d51dbe35c931f5829d70136acc6b2a7396e40e0c7d7da48cfc31c75a87c43d7d15b6b99dd9f11b54bfb2beaba279f9933ef19e49b0d46e581e10b60cce0ef4326772f71"}) (async)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)

04:21:24 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x8) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:24 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8008, &(0x7f0000000300)={0xa, 0x0, 0x400000, @mcast1, 0xffffffff}, 0xffffffffffffff7d)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x6, 0x20080)
r3 = socket$pptp(0x18, 0x1, 0x2)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000280))
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000002c0)={0x1100, r0}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1d}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}}, 0xf9583a81671795ce) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, &(0x7f0000000000)="a68b22c7fd80bf5c06301fead7317d341c6f43034edcdbddb7503a2be747ea1c320ea0e8bbf3e0a6007fce9aab8a10f54a65c16986859f51ea4ab0c113a19c1f8078d11144ea3d2b84055797916c5ee154a40083d648345a0bfbc091149e082225ff48662cf57f0161ab024ed04ad197242cb438b98eb64bfeeb77a8a90ac47bfab57e2747604a195bf48f2c2040ee312e0cd538860ed287360188fec0ac30a252895b462b7710579961317e30c0afc6fa564577ce3dc9c03564699a5668ce862fc9c39f7d558c9557e1eec46d4a455deacc2aa898286cf606", 0xd9, 0x4000000, 0x0, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000000)={0x57, 0x460, 0xfffa, {0x87, 0x81d7}, {0x1648}, @ramp={0x1, 0x2, {0x3, 0x101, 0x4a1b, 0x8}}})

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x3e39000000000000}, 0x0)

04:21:24 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x900)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x6, 0xfffffffc])

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x4000000}, 0x300}, 0x0)

04:21:24 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_VLANID={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080}, 0x80)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x6000000000000000}, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000000)={0x57, 0x460, 0xfffa, {0x87, 0x81d7}, {0x1648}, @ramp={0x1, 0x2, {0x3, 0x101, 0x4a1b, 0x8}}})

04:21:24 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8008, &(0x7f0000000300)={0xa, 0x0, 0x400000, @mcast1, 0xffffffff}, 0xffffffffffffff7d) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x6, 0x20080) (async)
r3 = socket$pptp(0x18, 0x1, 0x2)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000280)) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f00000002c0)={0x1100, r0}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, 0x0, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1d}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}}, 0xf9583a81671795ce) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, &(0x7f0000000000)="a68b22c7fd80bf5c06301fead7317d341c6f43034edcdbddb7503a2be747ea1c320ea0e8bbf3e0a6007fce9aab8a10f54a65c16986859f51ea4ab0c113a19c1f8078d11144ea3d2b84055797916c5ee154a40083d648345a0bfbc091149e082225ff48662cf57f0161ab024ed04ad197242cb438b98eb64bfeeb77a8a90ac47bfab57e2747604a195bf48f2c2040ee312e0cd538860ed287360188fec0ac30a252895b462b7710579961317e30c0afc6fa564577ce3dc9c03564699a5668ce862fc9c39f7d558c9557e1eec46d4a455deacc2aa898286cf606", 0xd9, 0x4000000, 0x0, 0x0)

04:21:24 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x900)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x6, 0xfffffffc])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x900) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x6, 0xfffffffc]) (async)

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x7000000}, 0x300}, 0x0)

04:21:24 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_VLANID={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080}, 0x80) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x9effffff00000000}, 0x0)

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x10000000}, 0x300}, 0x0)

04:21:24 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_VLANID={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40080}, 0x80) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:24 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$sock_bt_hci(r1, 0x400448e2, &(0x7f0000000140)="e4270dca5a58d3932a7f032bdd30714cae2ac2c552bfa1073e257a76268aa8a146a78e320b0237698e54dde064b21842956077e2c28909a59eee7613bcd0a0ffb9123e9f425c24a701b88b4048b2ed3417f5eefe7fda4b3ae1c1ca1a5405ceed8958665e5bb4")
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
bind$l2tp6(r2, &(0x7f0000000100)={0xa, 0x0, 0x43a, @dev={0xfe, 0x80, '\x00', 0x37}, 0x2, 0x2}, 0x20)
recvfrom$l2tp6(r0, &(0x7f0000000000)=""/243, 0xf3, 0x40000000, 0x0, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000000)={0x57, 0x460, 0xfffa, {0x87, 0x81d7}, {0x1648}, @ramp={0x1, 0x2, {0x3, 0x101, 0x4a1b, 0x8}}})

04:21:24 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x900)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x6, 0xfffffffc])

04:21:24 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x10001, 0x4000)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x6, 0x7, 0x400, 0x800, 0x413a, 0x9})

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
getitimer(0x1, &(0x7f0000000100))
getitimer(0x2, &(0x7f0000000040))

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x7ffff000}, 0x300}, 0x0)

04:21:24 executing program 3:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000100)=""/237)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x319601)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1f, 0x3, 0x101, 0x9, 0x0, 0x4})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="f870d949d4dd0dde485a80a97a4e82342d1f55c272aef06c9d85fb913e0aafd8f3fa21b939d760b134c1c18451f30b5107df8adf989278b05965bf38707344b7191908d1a1437e078a8e8002b287c2a7", @ANYRES16=r2, @ANYBLOB="04002cbd7000ffdbdf250700000005000600800000000800090003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000000)=""/41)

04:21:24 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x10001, 0x4000)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x6, 0x7, 0x400, 0x800, 0x413a, 0x9})

04:21:24 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xffffff7f00000000}, 0x0)

04:21:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x7ffffffff000}, 0x300}, 0x0)

04:21:24 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 32)
getitimer(0x1, &(0x7f0000000100)) (async, rerun: 32)
getitimer(0x2, &(0x7f0000000040))

04:21:25 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$sock_bt_hci(r1, 0x400448e2, &(0x7f0000000140)="e4270dca5a58d3932a7f032bdd30714cae2ac2c552bfa1073e257a76268aa8a146a78e320b0237698e54dde064b21842956077e2c28909a59eee7613bcd0a0ffb9123e9f425c24a701b88b4048b2ed3417f5eefe7fda4b3ae1c1ca1a5405ceed8958665e5bb4")
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
bind$l2tp6(r2, &(0x7f0000000100)={0xa, 0x0, 0x43a, @dev={0xfe, 0x80, '\x00', 0x37}, 0x2, 0x2}, 0x20)
recvfrom$l2tp6(r0, &(0x7f0000000000)=""/243, 0xf3, 0x40000000, 0x0, 0x0)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$sock_bt_hci(r1, 0x400448e2, &(0x7f0000000140)="e4270dca5a58d3932a7f032bdd30714cae2ac2c552bfa1073e257a76268aa8a146a78e320b0237698e54dde064b21842956077e2c28909a59eee7613bcd0a0ffb9123e9f425c24a701b88b4048b2ed3417f5eefe7fda4b3ae1c1ca1a5405ceed8958665e5bb4") (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
bind$l2tp6(r2, &(0x7f0000000100)={0xa, 0x0, 0x43a, @dev={0xfe, 0x80, '\x00', 0x37}, 0x2, 0x2}, 0x20) (async)
recvfrom$l2tp6(r0, &(0x7f0000000000)=""/243, 0xf3, 0x40000000, 0x0, 0x0) (async)

04:21:25 executing program 3:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000100)=""/237)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x319601)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1f, 0x3, 0x101, 0x9, 0x0, 0x4})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="f870d949d4dd0dde485a80a97a4e82342d1f55c272aef06c9d85fb913e0aafd8f3fa21b939d760b134c1c18451f30b5107df8adf989278b05965bf38707344b7191908d1a1437e078a8e8002b287c2a7", @ANYRES16=r2, @ANYBLOB="04002cbd7000ffdbdf250700000005000600800000000800090003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000000)=""/41)
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000100)=""/237) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x319601) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1f, 0x3, 0x101, 0x9, 0x0, 0x4}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="f870d949d4dd0dde485a80a97a4e82342d1f55c272aef06c9d85fb913e0aafd8f3fa21b939d760b134c1c18451f30b5107df8adf989278b05965bf38707344b7191908d1a1437e078a8e8002b287c2a7", @ANYRES16=r2, @ANYBLOB="04002cbd7000ffdbdf250700000005000600800000000800090003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000000)=""/41) (async)

04:21:25 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0) (async, rerun: 64)
r0 = syz_open_dev$vcsa(&(0x7f0000000040), 0x10001, 0x4000) (rerun: 64)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000080)={0x6, 0x7, 0x400, 0x800, 0x413a, 0x9})

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xffffffff00000000}, 0x0)

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0xf0ff7f00000000}, 0x300}, 0x0)

04:21:25 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
getitimer(0x1, &(0x7f0000000100))
getitimer(0x2, &(0x7f0000000040))

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0xfffffffffffff000}, 0x0)

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0xf0ffffff7f0000}, 0x300}, 0x0)

04:21:25 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:25 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/50)
setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000200)={0x3f}, 0x4)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$P9_RLCREATE(r2, &(0x7f00000001c0)={0x18, 0xf, 0x1, {{0x20, 0x3, 0x8}}}, 0x18)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000140)=""/72)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000000)=""/188)

04:21:25 executing program 3:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000100)=""/237)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x319601) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x1f, 0x3, 0x101, 0x9, 0x0, 0x4})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
sendmsg$L2TP_CMD_SESSION_MODIFY(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="f870d949d4dd0dde485a80a97a4e82342d1f55c272aef06c9d85fb913e0aafd8f3fa21b939d760b134c1c18451f30b5107df8adf989278b05965bf38707344b7191908d1a1437e078a8e8002b287c2a7", @ANYRES16=r2, @ANYBLOB="04002cbd7000ffdbdf250700000005000600800000000800090003000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000000)=""/41)

04:21:25 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 64)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$sock_bt_hci(r1, 0x400448e2, &(0x7f0000000140)="e4270dca5a58d3932a7f032bdd30714cae2ac2c552bfa1073e257a76268aa8a146a78e320b0237698e54dde064b21842956077e2c28909a59eee7613bcd0a0ffb9123e9f425c24a701b88b4048b2ed3417f5eefe7fda4b3ae1c1ca1a5405ceed8958665e5bb4")
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async, rerun: 32)
bind$l2tp6(r2, &(0x7f0000000100)={0xa, 0x0, 0x43a, @dev={0xfe, 0x80, '\x00', 0x37}, 0x2, 0x2}, 0x20) (async, rerun: 32)
recvfrom$l2tp6(r0, &(0x7f0000000000)=""/243, 0xf3, 0x40000000, 0x0, 0x0)

04:21:25 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x100000000000000}, 0x300}, 0x0)

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:25 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/50)
setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000200)={0x3f}, 0x4) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$P9_RLCREATE(r2, &(0x7f00000001c0)={0x18, 0xf, 0x1, {{0x20, 0x3, 0x8}}}, 0x18) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000140)=""/72) (async)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000000)=""/188)

04:21:25 executing program 3:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000440)={0x18, 0x73, 0x2, {{0x1, 0x4, 0x7}, 0x7}}, 0x18)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000280)="6f04ed5b9e3fbcbc13d0390cd86f7ed9204eacd2b86a1af4", 0x0, 0x18)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0x5)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x7, 0x4)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/221)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000200)=""/66)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x803, 0xfffffffe])
r3 = syz_open_dev$evdev(&(0x7f0000000040), 0xffffffffffff0f09, 0x10000)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000100)=""/178)
r4 = landlock_create_ruleset(&(0x7f00000002c0)={0x84}, 0x8, 0x0)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000300)={0x4, r5}, 0x0)

04:21:25 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x200000000000000}, 0x300}, 0x0)

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x0)

04:21:25 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100000001}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x400c000)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:25 executing program 3:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000440)={0x18, 0x73, 0x2, {{0x1, 0x4, 0x7}, 0x7}}, 0x18)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000280)="6f04ed5b9e3fbcbc13d0390cd86f7ed9204eacd2b86a1af4", 0x0, 0x18) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0x5) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x7, 0x4) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/221)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000200)=""/66)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x803, 0xfffffffe])
r3 = syz_open_dev$evdev(&(0x7f0000000040), 0xffffffffffff0f09, 0x10000)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000100)=""/178) (async, rerun: 32)
r4 = landlock_create_ruleset(&(0x7f00000002c0)={0x84}, 0x8, 0x0) (async, rerun: 32)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000300)={0x4, r5}, 0x0)

04:21:25 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/50)
setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000200)={0x3f}, 0x4)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$P9_RLCREATE(r2, &(0x7f00000001c0)={0x18, 0xf, 0x1, {{0x20, 0x3, 0x8}}}, 0x18)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000140)=""/72)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000000)=""/188)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/50) (async)
setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000200)={0x3f}, 0x4) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$P9_RLCREATE(r2, &(0x7f00000001c0)={0x18, 0xf, 0x1, {{0x20, 0x3, 0x8}}}, 0x18) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000140)=""/72) (async)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000000)=""/188) (async)

04:21:25 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7fffffffffffffff, 0x200002)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xca}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xb2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x40)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/193)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x400000000000000}, 0x300}, 0x0)

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x3}, 0x0)

04:21:25 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100000001}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x400c000)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100000001}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x400c000) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:25 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7fffffffffffffff, 0x200002)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xca}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xb2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x40)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/193)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])

04:21:25 executing program 3:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000440)={0x18, 0x73, 0x2, {{0x1, 0x4, 0x7}, 0x7}}, 0x18)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000280)="6f04ed5b9e3fbcbc13d0390cd86f7ed9204eacd2b86a1af4", 0x0, 0x18)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0x5)
r1 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x7, 0x4)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/221)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000200)=""/66)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x803, 0xfffffffe])
r3 = syz_open_dev$evdev(&(0x7f0000000040), 0xffffffffffff0f09, 0x10000)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000100)=""/178)
r4 = landlock_create_ruleset(&(0x7f00000002c0)={0x84}, 0x8, 0x0)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000300)={0x4, r5}, 0x0)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000440)={0x18, 0x73, 0x2, {{0x1, 0x4, 0x7}, 0x7}}, 0x18) (async)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000280)="6f04ed5b9e3fbcbc13d0390cd86f7ed9204eacd2b86a1af4", 0x0, 0x18) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0x5) (async)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x7, 0x4) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/221) (async)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000200)=""/66) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x803, 0xfffffffe]) (async)
syz_open_dev$evdev(&(0x7f0000000040), 0xffffffffffff0f09, 0x10000) (async)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000100)=""/178) (async)
landlock_create_ruleset(&(0x7f00000002c0)={0x84}, 0x8, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000300)={0x4, r5}, 0x0) (async)

04:21:25 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffffffffffffff, 0x100)
write$evdev(r0, &(0x7f0000000040)=[{{0x77359400}, 0x3, 0x4, 0xff}], 0x18)

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x700000000000000}, 0x300}, 0x0)

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0)

04:21:25 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, 0x0, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100000001}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x400c000)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x1000000000000000}, 0x300}, 0x0)

04:21:25 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x7}, 0x0)

04:21:25 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7fffffffffffffff, 0x200002)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xca}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xb2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x40)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/193)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$vcsa(&(0x7f0000000000), 0x7fffffffffffffff, 0x200002) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xca}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xb2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x40) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/193) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:25 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x8, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000000)=""/81)
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x40000)
ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r2, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x20)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x8c}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1ff}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8014}, 0x1080)

04:21:26 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffffffffffffff, 0x100)
write$evdev(r0, &(0x7f0000000040)=[{{0x77359400}, 0x3, 0x4, 0xff}], 0x18)

04:21:26 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x8001)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2])

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0xffffffff00000000}, 0x300}, 0x0)

04:21:26 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xffffffffffffffff, 0x100)
write$evdev(r0, &(0x7f0000000040)=[{{0x77359400}, 0x3, 0x4, 0xff}], 0x18)

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x0)

04:21:26 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x8, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async, rerun: 32)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000000)=""/81) (rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x40000)
ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) (async)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r2, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x20)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x8c}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1ff}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8014}, 0x1080)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4040, 0x0)

04:21:26 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x8001) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2])

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xe}, 0x0)

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2}, 0x0)

04:21:26 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xd5aa, 0x200000)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000180), 0xfffffffffffffffc, 0x5551011bcc31eeb8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r4 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x88200)
clock_gettime(0x0, &(0x7f0000000980)={<r5=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r5, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_gettime(0x0, &(0x7f0000000980)={<r6=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r6, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r3, @ANYRES16=r6, @ANYRESHEX=r1], 0x38}, 0x1, 0x0, 0x0, 0x200080c0}, 0x104)
syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r7 = syz_open_dev$evdev(&(0x7f0000000300), 0xff, 0x2000)
ioctl$EVIOCSCLOCKID(r7, 0x400445a0, &(0x7f0000000340)=0x7)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/55)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4040, 0x0)

04:21:26 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x8, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000000)=""/81) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x40000) (rerun: 64)
ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) (async)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r2, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x20) (async)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x7c, r3, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x8c}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1ff}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x2}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8014}, 0x1080)

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3}, 0x0)

04:21:26 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x8001)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2])

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf}, 0x0)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4040, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4040, 0x0) (async)

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4}, 0x0)

04:21:26 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xd5aa, 0x200000)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000180), 0xfffffffffffffffc, 0x5551011bcc31eeb8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r4 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x88200)
clock_gettime(0x0, &(0x7f0000000980)={<r5=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r5, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_gettime(0x0, &(0x7f0000000980)={<r6=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r6, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r3, @ANYRES16=r6, @ANYRESHEX=r1], 0x38}, 0x1, 0x0, 0x0, 0x200080c0}, 0x104)
syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r7 = syz_open_dev$evdev(&(0x7f0000000300), 0xff, 0x2000)
ioctl$EVIOCSCLOCKID(r7, 0x400445a0, &(0x7f0000000340)=0x7)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/55)
syz_open_dev$evdev(&(0x7f00000000c0), 0xd5aa, 0x200000) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000180), 0xfffffffffffffffc, 0x5551011bcc31eeb8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x88200) (async)
clock_gettime(0x0, &(0x7f0000000980)) (async)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r5, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8}) (async)
clock_gettime(0x0, &(0x7f0000000980)) (async)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r6, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r3, @ANYRES16=r6, @ANYRESHEX=r1], 0x38}, 0x1, 0x0, 0x0, 0x200080c0}, 0x104) (async)
syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000300), 0xff, 0x2000) (async)
ioctl$EVIOCSCLOCKID(r7, 0x400445a0, &(0x7f0000000340)=0x7) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/55) (async)

04:21:26 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f0000000000), 0x8, 0x98000)
r1 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x100)
ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x100007, 0x29])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3)

04:21:26 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bond0\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_LNS_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x20048086}, 0x448d0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x60}, 0x0)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000002, 0x401800)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x3, 0x0, 0x80000001, 0x2a7, 0x6e, 0x1000})

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5}, 0x0)

04:21:26 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x8, 0x98000) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x100)
ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x100007, 0x29]) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3) (rerun: 64)

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf0}, 0x0)

04:21:26 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bond0\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_LNS_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x20048086}, 0x448d0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:26 executing program 1:
syz_open_dev$evdev(&(0x7f00000000c0), 0xd5aa, 0x200000) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000180), 0xfffffffffffffffc, 0x5551011bcc31eeb8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r4 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x88200) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r5=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r5, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_gettime(0x0, &(0x7f0000000980)={<r6=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r6, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r3, @ANYRES16=r6, @ANYRESHEX=r1], 0x38}, 0x1, 0x0, 0x0, 0x200080c0}, 0x104)
syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r7 = syz_open_dev$evdev(&(0x7f0000000300), 0xff, 0x2000)
ioctl$EVIOCSCLOCKID(r7, 0x400445a0, &(0x7f0000000340)=0x7) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/55)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000002, 0x401800)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x3, 0x0, 0x80000001, 0x2a7, 0x6e, 0x1000})
syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000002, 0x401800) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x3, 0x0, 0x80000001, 0x2a7, 0x6e, 0x1000}) (async)

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6}, 0x0)

04:21:26 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bond0\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_LNS_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x20048086}, 0x448d0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bond0\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_LNS_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x20048086}, 0x448d0) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x300}, 0x0)

04:21:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7}, 0x0)

04:21:26 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff)
r2 = geteuid()
getresgid(&(0x7f0000000140)=<r3=>0x0, &(0x7f0000000180), &(0x7f00000001c0))
write$P9_RSTATu(r1, &(0x7f0000000200)={0x70, 0x7d, 0x2, {{0x0, 0x5a, 0x1, 0x8001, {0x0, 0x1, 0x6}, 0xcbd0000, 0x2, 0x7, 0xb, 0xb, '/y\xd3\x11lvcsa#\x00', 0x3, '[-,', 0x7, '}{\\\\\\.\'', 0x12, '/dev/input/event#\x00'}, 0x1, '&', r2, r3, 0xee01}}, 0x70)
pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x80)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/custom0\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0xff)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000000)=""/155)

04:21:26 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000002, 0x401800)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x3, 0x0, 0x80000001, 0x2a7, 0x6e, 0x1000})

04:21:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x700}, 0x0)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8}, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x8, 0x98000) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000140), 0x0, 0x100)
ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x100007, 0x29]) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000001c0), 0x60c, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000000)=""/87)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000b00)=""/4096)
sendto$l2tp6(r1, &(0x7f0000000100)="52462ba7bc05d9d85d2c79018fef4e1c4f9a9deec081418345a483416dcfd6a52c5077f6d645a06cfc3690ec6dbf7404d8118a38c717589909bdd9d6ee10d8ce632bbf257e7d4cbb846e1e2d4447bd7290f9913ab8de8ce687cc4bb0656ccc8123205928c3aeefa36b8028d55813f0542f34629f5bed98bbbeb0eb2f258b380c6e146490f6b8683b2a", 0x89, 0x8801, 0x0, 0x0)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x8, 0x80000)
ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000200)=0x1)
r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x40)
ioctl$EVIOCGID(r3, 0x80084502, &(0x7f0000000280)=""/216)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async, rerun: 32)
r2 = geteuid() (async, rerun: 32)
getresgid(&(0x7f0000000140)=<r3=>0x0, &(0x7f0000000180), &(0x7f00000001c0))
write$P9_RSTATu(r1, &(0x7f0000000200)={0x70, 0x7d, 0x2, {{0x0, 0x5a, 0x1, 0x8001, {0x0, 0x1, 0x6}, 0xcbd0000, 0x2, 0x7, 0xb, 0xb, '/y\xd3\x11lvcsa#\x00', 0x3, '[-,', 0x7, '}{\\\\\\.\'', 0x12, '/dev/input/event#\x00'}, 0x1, '&', r2, r3, 0xee01}}, 0x70) (async)
pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x80) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/custom0\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0xff) (async)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000000)=""/155)

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000000)={&(0x7f0000000340)={{@local, 0x10000}, {@my=0x0, 0x2d5b}, 0x400, "128200cefa7979985e0a02c5b8c9f9075682fb14166fc9b014aac794d28cb506b9bca647ce1e2ba884d8a347f9bf2aea85bfaa4fdd150a198a8a291ae56f4c3224bc4fc747957c6cb5d51ec5f35e8e9105f06176f7cb95d761455909463e98afe0c98c749fca498426858778ef8196d3310b3873d9e634f2a8654b5df4a17d91ee21653e36e17e2f77b594ac19d234295e1883b7efb9d401310b0df89e43b2202cc2275624aa6f3bf8525f7bcf52d3cf2992f32c7f218a65366a4581c64a1bb9518fdf5428bd9cf809ed0392d8627ca280309f26fb404f87e1ca0bc5f267c965014a27895030130edffab1610212773dcc4500a4255ce65aab5b2b06a6851ef735f66639ef3c2d0b8d883adc238f04f3c7278d68b8bf1a6f8658d75b550f8f9aa3fc3d98a51f74517c68d1ee843c9ba50c0bb7a816cd0f15ae109197fefb63866652b49cff29a8c0a75068797a0d6820822e685f98a5d8b795661b2c8585324208c06d3851d1b875bfde7c2e545f21d30276ac6621b3f35015e9658c6d3d9237f690cb6321009539a46798db4285df0c62ecce36ec523b8de41f4e23b0936a7c6b5d8accd1526619227e4dcab040ba447c814724e61a3bfce09bbcef34d5e0df20560b12643cd17292e8e77c36dd5bf66133657f03d350a44670a5fd651b9c904bc7903d5680a6eef4336c48ae9432d07603061b806c9a1e2cef807c38e316b70a4a5fa8c1b19037c19c61f4b8265ed2f8fb2876ba06fa9c49bb934583f99cdced162d78a2d09da19c92ba8a3a9356d0e0fb92f30dc570d6b473c8b13a8a1fcda85af2c9395c6ff20de7191fbeef77bb27c0ca1681ea344b6e83f125b10f867ba282fd62d8113d37c1972cd3f67f8c89c504d484a81b81cd2087724eba0a65db90a9be7b854c5b7828b9305f4c972718f6a1dfa8782c1a1fc4cd817e4b8eb703c8b2b315cc68bff16203e442813e246f6dcdd381986629c75e7b87930948ef9b0e08f6e7ee309f61826714ac70caa811ea58cae5f9982e79d7de45db1eb36f4a18c6729c618203c759db1cbfd09a44faa9ce7f80f62b82d7fa012c0a8c60b45f929d5a2bc6efa892718b6b4fcf0cb24049fd77deca4c17c6a2061e283ed4dfaf62d750513457ff048a4d4e6ca8009b1d0d8c3d28b9f1577f6ba757acf104f9581b0785e32421d350d166d5cac3b1c7ec13a8ff172520b61b4d38eebfa5dce7adb18df9ba53aff6c1d3a85f15b4b5024da22feab522f281c48f98f281e3861a3086029c7aa31c6dfe36f175f78b56af72e74751d54994620a89ba502e5baf1e8e6aab3edfd221ecc16f2c46fb8bb3af3a3230114bbaa52054587e306ac8b4812d2fda05255250dce9a6dba9dcf32b1cf212ba6f179ae180b44ae8f381e902019fa1b5bbece58ed2d3e070b98861fdc0d136e6fd5eef9d0fe8e7a8fecc523a16b0"}, 0x418, 0xc59f})

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xe00}, 0x0)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9}, 0x0)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf00}, 0x0)

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000000)={&(0x7f0000000340)={{@local, 0x10000}, {@my=0x0, 0x2d5b}, 0x400, "128200cefa7979985e0a02c5b8c9f9075682fb14166fc9b014aac794d28cb506b9bca647ce1e2ba884d8a347f9bf2aea85bfaa4fdd150a198a8a291ae56f4c3224bc4fc747957c6cb5d51ec5f35e8e9105f06176f7cb95d761455909463e98afe0c98c749fca498426858778ef8196d3310b3873d9e634f2a8654b5df4a17d91ee21653e36e17e2f77b594ac19d234295e1883b7efb9d401310b0df89e43b2202cc2275624aa6f3bf8525f7bcf52d3cf2992f32c7f218a65366a4581c64a1bb9518fdf5428bd9cf809ed0392d8627ca280309f26fb404f87e1ca0bc5f267c965014a27895030130edffab1610212773dcc4500a4255ce65aab5b2b06a6851ef735f66639ef3c2d0b8d883adc238f04f3c7278d68b8bf1a6f8658d75b550f8f9aa3fc3d98a51f74517c68d1ee843c9ba50c0bb7a816cd0f15ae109197fefb63866652b49cff29a8c0a75068797a0d6820822e685f98a5d8b795661b2c8585324208c06d3851d1b875bfde7c2e545f21d30276ac6621b3f35015e9658c6d3d9237f690cb6321009539a46798db4285df0c62ecce36ec523b8de41f4e23b0936a7c6b5d8accd1526619227e4dcab040ba447c814724e61a3bfce09bbcef34d5e0df20560b12643cd17292e8e77c36dd5bf66133657f03d350a44670a5fd651b9c904bc7903d5680a6eef4336c48ae9432d07603061b806c9a1e2cef807c38e316b70a4a5fa8c1b19037c19c61f4b8265ed2f8fb2876ba06fa9c49bb934583f99cdced162d78a2d09da19c92ba8a3a9356d0e0fb92f30dc570d6b473c8b13a8a1fcda85af2c9395c6ff20de7191fbeef77bb27c0ca1681ea344b6e83f125b10f867ba282fd62d8113d37c1972cd3f67f8c89c504d484a81b81cd2087724eba0a65db90a9be7b854c5b7828b9305f4c972718f6a1dfa8782c1a1fc4cd817e4b8eb703c8b2b315cc68bff16203e442813e246f6dcdd381986629c75e7b87930948ef9b0e08f6e7ee309f61826714ac70caa811ea58cae5f9982e79d7de45db1eb36f4a18c6729c618203c759db1cbfd09a44faa9ce7f80f62b82d7fa012c0a8c60b45f929d5a2bc6efa892718b6b4fcf0cb24049fd77deca4c17c6a2061e283ed4dfaf62d750513457ff048a4d4e6ca8009b1d0d8c3d28b9f1577f6ba757acf104f9581b0785e32421d350d166d5cac3b1c7ec13a8ff172520b61b4d38eebfa5dce7adb18df9ba53aff6c1d3a85f15b4b5024da22feab522f281c48f98f281e3861a3086029c7aa31c6dfe36f175f78b56af72e74751d54994620a89ba502e5baf1e8e6aab3edfd221ecc16f2c46fb8bb3af3a3230114bbaa52054587e306ac8b4812d2fda05255250dce9a6dba9dcf32b1cf212ba6f179ae180b44ae8f381e902019fa1b5bbece58ed2d3e070b98861fdc0d136e6fd5eef9d0fe8e7a8fecc523a16b0"}, 0x418, 0xc59f})

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff)
r2 = geteuid()
getresgid(&(0x7f0000000140)=<r3=>0x0, &(0x7f0000000180), &(0x7f00000001c0))
write$P9_RSTATu(r1, &(0x7f0000000200)={0x70, 0x7d, 0x2, {{0x0, 0x5a, 0x1, 0x8001, {0x0, 0x1, 0x6}, 0xcbd0000, 0x2, 0x7, 0xb, 0xb, '/y\xd3\x11lvcsa#\x00', 0x3, '[-,', 0x7, '}{\\\\\\.\'', 0x12, '/dev/input/event#\x00'}, 0x1, '&', r2, r3, 0xee01}}, 0x70)
pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x80)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/custom0\x00', 0x800, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0xff)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000000)=""/155)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async)
geteuid() (async)
getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) (async)
write$P9_RSTATu(r1, &(0x7f0000000200)={0x70, 0x7d, 0x2, {{0x0, 0x5a, 0x1, 0x8001, {0x0, 0x1, 0x6}, 0xcbd0000, 0x2, 0x7, 0xb, 0xb, '/y\xd3\x11lvcsa#\x00', 0x3, '[-,', 0x7, '}{\\\\\\.\'', 0x12, '/dev/input/event#\x00'}, 0x1, '&', r2, r3, 0xee01}}, 0x70) (async)
pipe2$watch_queue(&(0x7f0000000280), 0x80) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/custom0\x00', 0x800, 0x0) (async)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0xff) (async)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000000)=""/155) (async)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000001c0), 0x60c, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 32)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000000)=""/87) (rerun: 32)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000b00)=""/4096) (async)
sendto$l2tp6(r1, &(0x7f0000000100)="52462ba7bc05d9d85d2c79018fef4e1c4f9a9deec081418345a483416dcfd6a52c5077f6d645a06cfc3690ec6dbf7404d8118a38c717589909bdd9d6ee10d8ce632bbf257e7d4cbb846e1e2d4447bd7290f9913ab8de8ce687cc4bb0656ccc8123205928c3aeefa36b8028d55813f0542f34629f5bed98bbbeb0eb2f258b380c6e146490f6b8683b2a", 0x89, 0x8801, 0x0, 0x0) (async, rerun: 64)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x8, 0x80000) (rerun: 64)
ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000200)=0x1) (async)
r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x40)
ioctl$EVIOCGID(r3, 0x80084502, &(0x7f0000000280)=""/216) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000100)=""/76)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa}, 0x0)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x393e}, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000100)=""/76)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb}, 0x0)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000001c0), 0x60c, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000000)=""/87)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000b00)=""/4096)
sendto$l2tp6(r1, &(0x7f0000000100)="52462ba7bc05d9d85d2c79018fef4e1c4f9a9deec081418345a483416dcfd6a52c5077f6d645a06cfc3690ec6dbf7404d8118a38c717589909bdd9d6ee10d8ce632bbf257e7d4cbb846e1e2d4447bd7290f9913ab8de8ce687cc4bb0656ccc8123205928c3aeefa36b8028d55813f0542f34629f5bed98bbbeb0eb2f258b380c6e146490f6b8683b2a", 0x89, 0x8801, 0x0, 0x0)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x8, 0x80000)
ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000200)=0x1)
r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x40)
ioctl$EVIOCGID(r3, 0x80084502, &(0x7f0000000280)=""/216) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000000)={&(0x7f0000000340)={{@local, 0x10000}, {@my=0x0, 0x2d5b}, 0x400, "128200cefa7979985e0a02c5b8c9f9075682fb14166fc9b014aac794d28cb506b9bca647ce1e2ba884d8a347f9bf2aea85bfaa4fdd150a198a8a291ae56f4c3224bc4fc747957c6cb5d51ec5f35e8e9105f06176f7cb95d761455909463e98afe0c98c749fca498426858778ef8196d3310b3873d9e634f2a8654b5df4a17d91ee21653e36e17e2f77b594ac19d234295e1883b7efb9d401310b0df89e43b2202cc2275624aa6f3bf8525f7bcf52d3cf2992f32c7f218a65366a4581c64a1bb9518fdf5428bd9cf809ed0392d8627ca280309f26fb404f87e1ca0bc5f267c965014a27895030130edffab1610212773dcc4500a4255ce65aab5b2b06a6851ef735f66639ef3c2d0b8d883adc238f04f3c7278d68b8bf1a6f8658d75b550f8f9aa3fc3d98a51f74517c68d1ee843c9ba50c0bb7a816cd0f15ae109197fefb63866652b49cff29a8c0a75068797a0d6820822e685f98a5d8b795661b2c8585324208c06d3851d1b875bfde7c2e545f21d30276ac6621b3f35015e9658c6d3d9237f690cb6321009539a46798db4285df0c62ecce36ec523b8de41f4e23b0936a7c6b5d8accd1526619227e4dcab040ba447c814724e61a3bfce09bbcef34d5e0df20560b12643cd17292e8e77c36dd5bf66133657f03d350a44670a5fd651b9c904bc7903d5680a6eef4336c48ae9432d07603061b806c9a1e2cef807c38e316b70a4a5fa8c1b19037c19c61f4b8265ed2f8fb2876ba06fa9c49bb934583f99cdced162d78a2d09da19c92ba8a3a9356d0e0fb92f30dc570d6b473c8b13a8a1fcda85af2c9395c6ff20de7191fbeef77bb27c0ca1681ea344b6e83f125b10f867ba282fd62d8113d37c1972cd3f67f8c89c504d484a81b81cd2087724eba0a65db90a9be7b854c5b7828b9305f4c972718f6a1dfa8782c1a1fc4cd817e4b8eb703c8b2b315cc68bff16203e442813e246f6dcdd381986629c75e7b87930948ef9b0e08f6e7ee309f61826714ac70caa811ea58cae5f9982e79d7de45db1eb36f4a18c6729c618203c759db1cbfd09a44faa9ce7f80f62b82d7fa012c0a8c60b45f929d5a2bc6efa892718b6b4fcf0cb24049fd77deca4c17c6a2061e283ed4dfaf62d750513457ff048a4d4e6ca8009b1d0d8c3d28b9f1577f6ba757acf104f9581b0785e32421d350d166d5cac3b1c7ec13a8ff172520b61b4d38eebfa5dce7adb18df9ba53aff6c1d3a85f15b4b5024da22feab522f281c48f98f281e3861a3086029c7aa31c6dfe36f175f78b56af72e74751d54994620a89ba502e5baf1e8e6aab3edfd221ecc16f2c46fb8bb3af3a3230114bbaa52054587e306ac8b4812d2fda05255250dce9a6dba9dcf32b1cf212ba6f179ae180b44ae8f381e902019fa1b5bbece58ed2d3e070b98861fdc0d136e6fd5eef9d0fe8e7a8fecc523a16b0"}, 0x418, 0xc59f})

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x41ffffffffffff, 0x400200)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000080)={{@host, 0x4f3c}, 0x0, 0x1, 0x6})
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x9, 0x1f, 0x1, 0x7, 0x7, 0x800})
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x3e39}, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000100)=""/76)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc}, 0x0)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/85)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80) (async, rerun: 64)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x41ffffffffffff, 0x400200) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000080)={{@host, 0x4f3c}, 0x0, 0x1, 0x6}) (async)
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x9, 0x1f, 0x1, 0x7, 0x7, 0x800})
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd}, 0x0)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x6000}, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x204000)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/85) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x41ffffffffffff, 0x400200)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000080)={{@host, 0x4f3c}, 0x0, 0x1, 0x6})
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x9, 0x1f, 0x1, 0x7, 0x7, 0x800}) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe}, 0x0)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf000}, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x204000)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/85)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/85) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x204000)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0)

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf}, 0x0)

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x4, 0x7f, 0x8001, {0x2, 0xfc01}, {0x3, 0x9}, @const={0x0, {0x0, 0x1, 0x7, 0x6}}})
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:27 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x78, 0x0, &(0x7f0000000140)=[@decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)=ANY=[@ANYBLOB="852a627703788b0e29f04e8a421b4b580a11000001000000000000000000000000000000856164660000000003000000000000000100000000000000330000000000000085616466000000000800"/88], &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1040}, @register_looper, @increfs={0x40046304, 0x2}, @exit_looper, @request_death={0x400c630e, 0x3}, @enter_looper], 0x23, 0x0, &(0x7f00000001c0)="6a43680e13a4d53ca7f8c97bf030bc7499d45c4fd71caa2bf9dccdb1bed4a71658e9ce"})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x100007fe, 0x80])

04:21:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10}, 0x0)

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x4, 0x7f, 0x8001, {0x2, 0xfc01}, {0x3, 0x9}, @const={0x0, {0x0, 0x1, 0x7, 0x6}}}) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:27 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x0, 0xd44a])
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000100)="9e58a1c01a520f7bd4d142041db9184701d8fd593f4584984d35145206e0190bb8dd906e7e19721b5c3483896761cb403604b5032d3cb5d572bd12c8d8caf97004d79ac9bbf4625b", 0x0, 0x48)

04:21:27 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x1000000}, 0x0)

04:21:27 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x78, 0x0, &(0x7f0000000140)=[@decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)=ANY=[@ANYBLOB="852a627703788b0e29f04e8a421b4b580a11000001000000000000000000000000000000856164660000000003000000000000000100000000000000330000000000000085616466000000000800"/88], &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1040}, @register_looper, @increfs={0x40046304, 0x2}, @exit_looper, @request_death={0x400c630e, 0x3}, @enter_looper], 0x23, 0x0, &(0x7f00000001c0)="6a43680e13a4d53ca7f8c97bf030bc7499d45c4fd71caa2bf9dccdb1bed4a71658e9ce"})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x100007fe, 0x80])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x78, 0x0, &(0x7f0000000140)=[@decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)=ANY=[@ANYBLOB="852a627703788b0e29f04e8a421b4b580a11000001000000000000000000000000000000856164660000000003000000000000000100000000000000330000000000000085616466000000000800"/88], &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1040}, @register_looper, @increfs={0x40046304, 0x2}, @exit_looper, @request_death={0x400c630e, 0x3}, @enter_looper], 0x23, 0x0, &(0x7f00000001c0)="6a43680e13a4d53ca7f8c97bf030bc7499d45c4fd71caa2bf9dccdb1bed4a71658e9ce"}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x100007fe, 0x80]) (async)

04:21:27 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
landlock_restrict_self(r0, 0x0)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x100)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00012dbd7000fcdbdf25080000000500040004000000060003000200000009000000e26f6e645f736c6176655f31000000003f1a09a8e5b65090229e5ce78ae3b75ee83c25ceb1545bd6b1e64f68d8e0d3251b4123b3bf6c627bdfe61e070c0c97139c8ec58a12041a62f8d2f33cfd5601ed1ac7fda835c1f75b6c93eab341394d927504942c89fba68f49275d130c4d172a3d0b5785390000000000009bf473db"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8000)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:27 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x4, 0x7f, 0x8001, {0x2, 0xfc01}, {0x3, 0x9}, @const={0x0, {0x0, 0x1, 0x7, 0x6}}}) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x2000000}, 0x0)

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x0, 0xd44a])
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000100)="9e58a1c01a520f7bd4d142041db9184701d8fd593f4584984d35145206e0190bb8dd906e7e19721b5c3483896761cb403604b5032d3cb5d572bd12c8d8caf97004d79ac9bbf4625b", 0x0, 0x48)

04:21:28 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x78, 0x0, &(0x7f0000000140)=[@decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)=ANY=[@ANYBLOB="852a627703788b0e29f04e8a421b4b580a11000001000000000000000000000000000000856164660000000003000000000000000100000000000000330000000000000085616466000000000800"/88], &(0x7f0000000100)={0x0, 0x18, 0x38}}, 0x1040}, @register_looper, @increfs={0x40046304, 0x2}, @exit_looper, @request_death={0x400c630e, 0x3}, @enter_looper], 0x23, 0x0, &(0x7f00000001c0)="6a43680e13a4d53ca7f8c97bf030bc7499d45c4fd71caa2bf9dccdb1bed4a71658e9ce"})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x100007fe, 0x80])

04:21:28 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
landlock_restrict_self(r0, 0x0)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x100) (async)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00012dbd7000fcdbdf25080000000500040004000000060003000200000009000000e26f6e645f736c6176655f31000000003f1a09a8e5b65090229e5ce78ae3b75ee83c25ceb1545bd6b1e64f68d8e0d3251b4123b3bf6c627bdfe61e070c0c97139c8ec58a12041a62f8d2f33cfd5601ed1ac7fda835c1f75b6c93eab341394d927504942c89fba68f49275d130c4d172a3d0b5785390000000000009bf473db"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8000)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12}, 0x0)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x3000000}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x0, 0xd44a])
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000100)="9e58a1c01a520f7bd4d142041db9184701d8fd593f4584984d35145206e0190bb8dd906e7e19721b5c3483896761cb403604b5032d3cb5d572bd12c8d8caf97004d79ac9bbf4625b", 0x0, 0x48)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x0, 0xd44a]) (async)
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000100)="9e58a1c01a520f7bd4d142041db9184701d8fd593f4584984d35145206e0190bb8dd906e7e19721b5c3483896761cb403604b5032d3cb5d572bd12c8d8caf97004d79ac9bbf4625b", 0x0, 0x48) (async)

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/148)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/85)

04:21:28 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x800)
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x6, 0x301000)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x4, 0xffffff00])

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13}, 0x0)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

04:21:28 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
landlock_restrict_self(r0, 0x0) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x4, 0x100)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async, rerun: 32)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00012dbd7000fcdbdf25080000000500040004000000060003000200000009000000e26f6e645f736c6176655f31000000003f1a09a8e5b65090229e5ce78ae3b75ee83c25ceb1545bd6b1e64f68d8e0d3251b4123b3bf6c627bdfe61e070c0c97139c8ec58a12041a62f8d2f33cfd5601ed1ac7fda835c1f75b6c93eab341394d927504942c89fba68f49275d130c4d172a3d0b5785390000000000009bf473db"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8000)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000280)=""/183)

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/148)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/85)

04:21:28 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x800)
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x6, 0x301000)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x4, 0xffffff00])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x800) (async)
syz_open_dev$evdev(&(0x7f0000000080), 0x6, 0x301000) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x4, 0xffffff00]) (async)

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14}, 0x0)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x7000000}, 0x0)

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000000)=""/148)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/85)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000280)=""/183)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000280)=""/183) (async)

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15}, 0x0)

04:21:28 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x800)
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x6, 0x301000)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x4, 0xffffff00])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x800) (async)
syz_open_dev$evdev(&(0x7f0000000080), 0x6, 0x301000) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000040)=[0x4, 0xffffff00]) (async)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x8000000}, 0x0)

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x100, 0x200])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
read$msr(r2, &(0x7f0000000000)=""/36, 0x24)

04:21:28 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
getgroups(0x3, &(0x7f0000000040)=[<r2=>0xee01, 0x0, 0xee00])
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00])
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xe000000}, 0x0)

04:21:28 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0xb, 0x1)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0xcd0f, 0x2])

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000280)=""/183)

04:21:28 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0xb, 0x1)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0xcd0f, 0x2])

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x100, 0x200]) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
read$msr(r2, &(0x7f0000000000)=""/36, 0x24)

04:21:28 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
getgroups(0x3, &(0x7f0000000040)=[<r2=>0xee01, 0x0, 0xee00])
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00])
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
getgroups(0x3, &(0x7f0000000040)=[0xee01, 0x0, 0xee00]) (async)
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00]) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8) (async)

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x17}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x80000)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040))
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3f, 0x380ba1ddabafa385)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/98)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000180)=""/201)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf000000}, 0x0)

04:21:28 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0xb, 0x1)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0xcd0f, 0x2])

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x18}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x80000)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040)) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3f, 0x380ba1ddabafa385)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/98) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000180)=""/201)

04:21:28 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x100, 0x200])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
read$msr(r2, &(0x7f0000000000)=""/36, 0x24)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x3e390000}, 0x0)

04:21:28 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
getgroups(0x3, &(0x7f0000000040)=[<r2=>0xee01, 0x0, 0xee00])
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00])
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
getgroups(0x3, &(0x7f0000000040)=[0xee01, 0x0, 0xee00]) (async)
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00]) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8) (async)

04:21:28 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000))

04:21:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x19}, 0x0)

04:21:28 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x80000)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040))
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3f, 0x380ba1ddabafa385)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000100)=""/98) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000180)=""/201)

04:21:28 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x60000000}, 0x0)

04:21:28 executing program 1:
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(0xffffffffffffffff, 0x800443d3, &(0x7f0000000040)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x81, 0x0, 0x7})
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:28 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x840, &(0x7f0000000300)={0xa, 0x0, 0x7e, @loopback, 0xffffffff, 0x6}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800eddb", @ANYRES16=0x0, @ANYBLOB="000126bd7000fbdbdf250400000006001a004e210000080009000000000014001f00fe8000000000000000000000000000bb050006007e0000000500210001000000"], 0x48}, 0x1, 0x0, 0x0, 0x40004}, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x1a}, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000000)=""/107)

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000)) (async)

04:21:29 executing program 1:
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(0xffffffffffffffff, 0x800443d3, &(0x7f0000000040)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x81, 0x0, 0x7}) (async)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:29 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x840, &(0x7f0000000300)={0xa, 0x0, 0x7e, @loopback, 0xffffffff, 0x6}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800eddb", @ANYRES16=0x0, @ANYBLOB="000126bd7000fbdbdf250400000006001a004e210000080009000000000014001f00fe8000000000000000000000000000bb050006007e0000000500210001000000"], 0x48}, 0x1, 0x0, 0x0, 0x40004}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x840, &(0x7f0000000300)={0xa, 0x0, 0x7e, @loopback, 0xffffffff, 0x6}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800eddb", @ANYRES16=0x0, @ANYBLOB="000126bd7000fbdbdf250400000006001a004e210000080009000000000014001f00fe8000000000000000000000000000bb050006007e0000000500210001000000"], 0x48}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000000)=""/107)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000000)=""/107) (async)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x1b}, 0x0)

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000))

04:21:29 executing program 1:
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(0xffffffffffffffff, 0x800443d3, &(0x7f0000000040)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x81, 0x0, 0x7}) (async)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:29 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x840, &(0x7f0000000300)={0xa, 0x0, 0x7e, @loopback, 0xffffffff, 0x6}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800eddb", @ANYRES16=0x0, @ANYBLOB="000126bd7000fbdbdf250400000006001a004e210000080009000000000014001f00fe8000000000000000000000000000bb050006007e0000000500210001000000"], 0x48}, 0x1, 0x0, 0x0, 0x40004}, 0x0)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x1c}, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000000)=""/107)

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000100)=""/4096)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7, 0x1)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000080)={0x55, 0x42, 0x0, {0x1, 0x6}, {0x7, 0x20}, @period={0x59, 0x2, 0x0, 0x8, 0x3ff, {0x3, 0x55, 0x6, 0x9}, 0x3, &(0x7f0000000040)=[0x9, 0x6, 0x7]}})

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x1d}, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000000)=""/53)

04:21:29 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x52, 0x800, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffe}, 0x20)
syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x24101)

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000100)=""/4096)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7, 0x1)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000080)={0x55, 0x42, 0x0, {0x1, 0x6}, {0x7, 0x20}, @period={0x59, 0x2, 0x0, 0x8, 0x3ff, {0x3, 0x55, 0x6, 0x9}, 0x3, &(0x7f0000000040)=[0x9, 0x6, 0x7]}})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000100)=""/4096) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x7, 0x1) (async)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000080)={0x55, 0x42, 0x0, {0x1, 0x6}, {0x7, 0x20}, @period={0x59, 0x2, 0x0, 0x8, 0x3ff, {0x3, 0x55, 0x6, 0x9}, 0x3, &(0x7f0000000040)=[0x9, 0x6, 0x7]}}) (async)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x1e}, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0)

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async, rerun: 32)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000100)=""/4096) (rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7, 0x1)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000080)={0x55, 0x42, 0x0, {0x1, 0x6}, {0x7, 0x20}, @period={0x59, 0x2, 0x0, 0x8, 0x3ff, {0x3, 0x55, 0x6, 0x9}, 0x3, &(0x7f0000000040)=[0x9, 0x6, 0x7]}})

04:21:29 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x52, 0x800, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffe}, 0x20)
syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x24101)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x52, 0x800, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffe}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x24101) (async)

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000000)=""/53)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000000)=""/53) (async)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x21}, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0)

04:21:29 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x52, 0x800, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffe}, 0x20)
syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x24101)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x52, 0x800, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xfffffffe}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x24101) (async)

04:21:29 executing program 4:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000040)=0x9c)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffb, 0x400001)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x145)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/84)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000000)=""/53)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x22}, 0x0)

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x82000)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0xffffffff}, 0x0)

04:21:29 executing program 0:
setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80500, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x400088d, &(0x7f0000000240)={0xa, 0x0, 0x0, @empty}, 0x20)

04:21:29 executing program 4:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000040)=0x9c) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffb, 0x400001)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x145) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/84)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x2)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x23}, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000001c0)=""/170)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000280)=""/4096)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x1, 0x5551011bcc5865ba)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000000)=""/38)

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x82000)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:29 executing program 0:
setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80500, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x400088d, &(0x7f0000000240)={0xa, 0x0, 0x0, @empty}, 0x20)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x24}, 0x0)

04:21:29 executing program 4:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000040)=0x9c)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffb, 0x400001)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x145) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/84)

04:21:29 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x3)

04:21:29 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x82000)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:29 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000001c0)=""/170)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000280)=""/4096)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x1, 0x5551011bcc5865ba)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000000)=""/38)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000001c0)=""/170) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000280)=""/4096) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x1, 0x5551011bcc5865ba) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000000)=""/38) (async)

04:21:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x25}, 0x0)

04:21:29 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x7, 0x1])

04:21:29 executing program 0:
setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x4) (async)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80500, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x400088d, &(0x7f0000000240)={0xa, 0x0, 0x0, @empty}, 0x20)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x4)

04:21:30 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/122)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0xb57d)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000001c0)=""/170) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000280)=""/4096) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x1, 0x5551011bcc5865ba)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000000)=""/38)

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x26}, 0x0)

04:21:30 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x7, 0x1])

04:21:30 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x2, r1}, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x4}, 0x20)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x7)

04:21:30 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/122) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0xb57d)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000000))
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x27}, 0x0)

04:21:30 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x7, 0x1])

04:21:30 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x2, r1}, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x4}, 0x20)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x8)

04:21:30 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/122)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0xb57d)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/122) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0xb57d) (async)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000000))
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x28}, 0x0)

04:21:30 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x14c480}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x30, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040004}, 0x40810)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000000)=""/84)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$EVIOCSABS2F(r4, 0x401845ef, &(0x7f0000000540)={0x3, 0xe1e, 0x0, 0x101, 0x1, 0x7})
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, <r5=>0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000240)=[{}, {}], 0x10, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000300)}}, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x2c}}, 0x4000181)
r6 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={'ip6_vti0\x00', <r7=>r5, 0x29, 0x20, 0x0, 0xffff, 0x62, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, 0x7800, 0x700, 0x6604, 0x80000001}})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r6, 0x89f9, &(0x7f0000000800)={'syztnl1\x00', &(0x7f0000000780)={'ip6_vti0\x00', r7, 0x3b, 0x1f, 0x2e, 0x2, 0x2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7f47, 0x7800, 0x6, 0x80000001}})

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xe)

04:21:30 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x2, r1}, 0x0)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x4}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x2, r1}, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x4}, 0x20) (async)

04:21:30 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000200)={0xffffffffffffffff, 0x7fff})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
syz_open_dev$vcsa(&(0x7f0000000100), 0xa, 0x8802)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000240)=""/205)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff)
write$P9_RSTATu(r3, &(0x7f0000000340)={0x65, 0x7d, 0x2, {{0x0, 0x50, 0x5, 0x3, {0x10, 0x0, 0x4}, 0xa5b00000, 0x0, 0x0, 0x5, 0xb, '#&[}[&]$$^-', 0x2, '$@', 0x5, 'l2tp\x00', 0xb, '/dev/vcsa#\x00'}, 0x0, '', 0xee01, 0xee00}}, 0x65)
ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f0000000080)={0x67, 0x9, 0x1, 0x4c86, 0x4, 0x1000})
ioctl$EVIOCSREP(r1, 0x541b, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000000000)=""/81)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000000)) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x29}, 0x0)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf)

04:21:30 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2d)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000000)=""/12)
socket$bt_cmtp(0x1f, 0x3, 0x5)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x80000003])
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x40, 0x4c00c2)
write$P9_RXATTRCREATE(r2, &(0x7f0000000100)={0x7, 0x21, 0x1}, 0x7)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000500), r2)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000940)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r3, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x128, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/102, 0x66, 0x2, 0x7}, @fda={0x66646185, 0x6, 0x1, 0x11}, @fda={0x66646185, 0x7, 0x1, 0x1d}}, &(0x7f0000000240)={0x0, 0x28, 0x48}}, 0x400}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/157, 0x9d, 0x2, 0x2d}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/190, 0xbe, 0x2, 0x36}, @fda={0x66646185, 0xa, 0x0, 0xa}}, &(0x7f0000000480)={0x0, 0x28, 0x50}}, 0x40}, @decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x2}, @dead_binder_done, @request_death, @increfs_done={0x40106308, 0x1}, @enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="8561646600000000090000000000000002000000000000002d000000000000c9bcf69a05008561646600000000050000000000000000000000000000002a00000000000000db7666cdb8a6afd94fc1d5bf8a9117a6cb030000000001000000000000000100"], &(0x7f0000000540)={0x0, 0x20, 0x40}}, 0x1000}], 0xfd, 0x0, &(0x7f0000000740)="458dac1cf82bfac5fe7eda718be75cadb60e610dd0390e874b38a27f35beb88799f170a3c0f955b502da3f1415b34f941438dbf806fb6cc9506c991fbfd1a38f1e483c9811b1701ea04f877ea55051ebbe6a40bcc7755052217a3cb053e314807c37ba63ecb8634e63fac9a1d2f7916059d5acdd747475c72f303c3dd7fba379d49fcb3e2ec8c4b45ce6f50c316b224afc23240b7f26d105a1d11a38768a8689d082f9cee67a830c3684587ebab2a87d5eb0123cf1126162e9e6c7a1d8974c39cdc821888a6e532006ee1fc883dc8e24054cf4941bc340956f2abd5ccffd666294722166b1261eea0fc54498aab616ad8b4d199aa76ee683e084bc83f1"})

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2a}, 0x0)

04:21:30 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000200)={0xffffffffffffffff, 0x7fff})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 64)
syz_open_dev$vcsa(&(0x7f0000000100), 0xa, 0x8802) (rerun: 64)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000240)=""/205)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff)
write$P9_RSTATu(r3, &(0x7f0000000340)={0x65, 0x7d, 0x2, {{0x0, 0x50, 0x5, 0x3, {0x10, 0x0, 0x4}, 0xa5b00000, 0x0, 0x0, 0x5, 0xb, '#&[}[&]$$^-', 0x2, '$@', 0x5, 'l2tp\x00', 0xb, '/dev/vcsa#\x00'}, 0x0, '', 0xee01, 0xee00}}, 0x65) (async)
ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f0000000080)={0x67, 0x9, 0x1, 0x4c86, 0x4, 0x1000}) (async)
ioctl$EVIOCSREP(r1, 0x541b, 0x0) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000180), &(0x7f00000001c0)=0x4) (async)
ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000000000)=""/81)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x60)

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2b}, 0x0)

04:21:30 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2d) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000000)=""/12) (async)
socket$bt_cmtp(0x1f, 0x3, 0x5) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x80000003]) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x40, 0x4c00c2)
write$P9_RXATTRCREATE(r2, &(0x7f0000000100)={0x7, 0x21, 0x1}, 0x7)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000500), r2)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000940)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r3, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x128, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/102, 0x66, 0x2, 0x7}, @fda={0x66646185, 0x6, 0x1, 0x11}, @fda={0x66646185, 0x7, 0x1, 0x1d}}, &(0x7f0000000240)={0x0, 0x28, 0x48}}, 0x400}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/157, 0x9d, 0x2, 0x2d}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/190, 0xbe, 0x2, 0x36}, @fda={0x66646185, 0xa, 0x0, 0xa}}, &(0x7f0000000480)={0x0, 0x28, 0x50}}, 0x40}, @decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x2}, @dead_binder_done, @request_death, @increfs_done={0x40106308, 0x1}, @enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="8561646600000000090000000000000002000000000000002d000000000000c9bcf69a05008561646600000000050000000000000000000000000000002a00000000000000db7666cdb8a6afd94fc1d5bf8a9117a6cb030000000001000000000000000100"], &(0x7f0000000540)={0x0, 0x20, 0x40}}, 0x1000}], 0xfd, 0x0, &(0x7f0000000740)="458dac1cf82bfac5fe7eda718be75cadb60e610dd0390e874b38a27f35beb88799f170a3c0f955b502da3f1415b34f941438dbf806fb6cc9506c991fbfd1a38f1e483c9811b1701ea04f877ea55051ebbe6a40bcc7755052217a3cb053e314807c37ba63ecb8634e63fac9a1d2f7916059d5acdd747475c72f303c3dd7fba379d49fcb3e2ec8c4b45ce6f50c316b224afc23240b7f26d105a1d11a38768a8689d082f9cee67a830c3684587ebab2a87d5eb0123cf1126162e9e6c7a1d8974c39cdc821888a6e532006ee1fc883dc8e24054cf4941bc340956f2abd5ccffd666294722166b1261eea0fc54498aab616ad8b4d199aa76ee683e084bc83f1"})

04:21:30 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x14c480}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x30, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040004}, 0x40810) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1) (async)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000000)=""/84) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
ioctl$EVIOCSABS2F(r4, 0x401845ef, &(0x7f0000000540)={0x3, 0xe1e, 0x0, 0x101, 0x1, 0x7})
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, <r5=>0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000240)=[{}, {}], 0x10, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000300)}}, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x2c}}, 0x4000181) (async)
r6 = socket$inet6_udplite(0xa, 0x2, 0x88) (async)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={'ip6_vti0\x00', <r7=>r5, 0x29, 0x20, 0x0, 0xffff, 0x62, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, 0x7800, 0x700, 0x6604, 0x80000001}})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r6, 0x89f9, &(0x7f0000000800)={'syztnl1\x00', &(0x7f0000000780)={'ip6_vti0\x00', r7, 0x3b, 0x1f, 0x2e, 0x2, 0x2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7f47, 0x7800, 0x6, 0x80000001}})

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf0)

04:21:30 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2d) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:30 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000200)={0xffffffffffffffff, 0x7fff}) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
syz_open_dev$vcsa(&(0x7f0000000100), 0xa, 0x8802)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000240)=""/205) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff)
write$P9_RSTATu(r3, &(0x7f0000000340)={0x65, 0x7d, 0x2, {{0x0, 0x50, 0x5, 0x3, {0x10, 0x0, 0x4}, 0xa5b00000, 0x0, 0x0, 0x5, 0xb, '#&[}[&]$$^-', 0x2, '$@', 0x5, 'l2tp\x00', 0xb, '/dev/vcsa#\x00'}, 0x0, '', 0xee01, 0xee00}}, 0x65)
ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f0000000080)={0x67, 0x9, 0x1, 0x4c86, 0x4, 0x1000}) (async)
ioctl$EVIOCSREP(r1, 0x541b, 0x0) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000000000)=""/81)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x300)

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2c}, 0x0)

04:21:30 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000000)=""/12) (async)
socket$bt_cmtp(0x1f, 0x3, 0x5) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x80000003])
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x40, 0x4c00c2)
write$P9_RXATTRCREATE(r2, &(0x7f0000000100)={0x7, 0x21, 0x1}, 0x7) (async)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000500), r2)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000940)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x38, r3, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x128, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/102, 0x66, 0x2, 0x7}, @fda={0x66646185, 0x6, 0x1, 0x11}, @fda={0x66646185, 0x7, 0x1, 0x1d}}, &(0x7f0000000240)={0x0, 0x28, 0x48}}, 0x400}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/157, 0x9d, 0x2, 0x2d}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/190, 0xbe, 0x2, 0x36}, @fda={0x66646185, 0xa, 0x0, 0xa}}, &(0x7f0000000480)={0x0, 0x28, 0x50}}, 0x40}, @decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x2}, @dead_binder_done, @request_death, @increfs_done={0x40106308, 0x1}, @enter_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="8561646600000000090000000000000002000000000000002d000000000000c9bcf69a05008561646600000000050000000000000000000000000000002a00000000000000db7666cdb8a6afd94fc1d5bf8a9117a6cb030000000001000000000000000100"], &(0x7f0000000540)={0x0, 0x20, 0x40}}, 0x1000}], 0xfd, 0x0, &(0x7f0000000740)="458dac1cf82bfac5fe7eda718be75cadb60e610dd0390e874b38a27f35beb88799f170a3c0f955b502da3f1415b34f941438dbf806fb6cc9506c991fbfd1a38f1e483c9811b1701ea04f877ea55051ebbe6a40bcc7755052217a3cb053e314807c37ba63ecb8634e63fac9a1d2f7916059d5acdd747475c72f303c3dd7fba379d49fcb3e2ec8c4b45ce6f50c316b224afc23240b7f26d105a1d11a38768a8689d082f9cee67a830c3684587ebab2a87d5eb0123cf1126162e9e6c7a1d8974c39cdc821888a6e532006ee1fc883dc8e24054cf4941bc340956f2abd5ccffd666294722166b1261eea0fc54498aab616ad8b4d199aa76ee683e084bc83f1"})

04:21:30 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x14c480}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x30, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040004}, 0x40810)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000000)=""/84)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
ioctl$EVIOCSABS2F(r4, 0x401845ef, &(0x7f0000000540)={0x3, 0xe1e, 0x0, 0x101, 0x1, 0x7})
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, <r5=>0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000240)=[{}, {}], 0x10, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000300)}}, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x2c}}, 0x4000181)
r6 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={'ip6_vti0\x00', <r7=>r5, 0x29, 0x20, 0x0, 0xffff, 0x62, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, 0x7800, 0x700, 0x6604, 0x80000001}})
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r6, 0x89f9, &(0x7f0000000800)={'syztnl1\x00', &(0x7f0000000780)={'ip6_vti0\x00', r7, 0x3b, 0x1f, 0x2e, 0x2, 0x2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7f47, 0x7800, 0x6, 0x80000001}})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x14c480}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x30, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040004}, 0x40810) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1) (async)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000000)=""/84) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
ioctl$EVIOCSABS2F(r4, 0x401845ef, &(0x7f0000000540)={0x3, 0xe1e, 0x0, 0x101, 0x1, 0x7}) (async)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000240)=[{}, {}], 0x10, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x10, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r3, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x2c}}, 0x4000181) (async)
socket$inet6_udplite(0xa, 0x2, 0x88) (async)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={'ip6_vti0\x00', r5, 0x29, 0x20, 0x0, 0xffff, 0x62, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, 0x7800, 0x700, 0x6604, 0x80000001}}) (async)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r6, 0x89f9, &(0x7f0000000800)={'syztnl1\x00', &(0x7f0000000780)={'ip6_vti0\x00', r7, 0x3b, 0x1f, 0x2e, 0x2, 0x2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7f47, 0x7800, 0x6, 0x80000001}}) (async)

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x700)

04:21:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2d}, 0x0)

04:21:30 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x672c22)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000000)=""/105)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)

04:21:30 executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080))
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000000)={0x5c08, 0x0, 0x5, 0x4, 0x9, 0x2})
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:30 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xc)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0})
clock_gettime(0x0, &(0x7f0000000200)={<r4=>0x0, <r5=>0x0})
clock_gettime(0x0, &(0x7f0000000240)={<r6=>0x0, <r7=>0x0})
write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{r6, r7/1000+60000}, 0x0, 0x9, 0x7ff}, {{}, 0x3, 0xb, 0x4}, {{r4, r5/1000+10000}, 0x3, 0x80, 0x8}, {{r2, r3/1000+60000}, 0x1f, 0x3, 0x1}, {{0x77359400}, 0x0, 0x0, 0x9}, {{0x77359400}, 0x11, 0x1000, 0xd80d}], 0x90)
r8 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x410003)
ioctl$EVIOCGABS2F(r8, 0x8018456f, &(0x7f00000001c0)=""/55)
setsockopt$bt_hci_HCI_TIME_STAMP(r8, 0x0, 0x3, &(0x7f0000000280)=0x9, 0x4)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x81])

04:21:30 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xe00)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2e}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf00)

04:21:31 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x672c22)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000000)=""/105)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x672c22) (async)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000000)=""/105) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async)

04:21:31 executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000000)={0x5c08, 0x0, 0x5, 0x4, 0x9, 0x2})
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:31 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0xfffffffc])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
setsockopt$inet_dccp_int(r1, 0x21, 0xa, &(0x7f0000000000)=0x401, 0x4)

04:21:31 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xc) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0}) (async)
clock_gettime(0x0, &(0x7f0000000200)={<r4=>0x0, <r5=>0x0}) (async)
clock_gettime(0x0, &(0x7f0000000240)={<r6=>0x0, <r7=>0x0})
write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{r6, r7/1000+60000}, 0x0, 0x9, 0x7ff}, {{}, 0x3, 0xb, 0x4}, {{r4, r5/1000+10000}, 0x3, 0x80, 0x8}, {{r2, r3/1000+60000}, 0x1f, 0x3, 0x1}, {{0x77359400}, 0x0, 0x0, 0x9}, {{0x77359400}, 0x11, 0x1000, 0xd80d}], 0x90) (async)
r8 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x410003)
ioctl$EVIOCGABS2F(r8, 0x8018456f, &(0x7f00000001c0)=""/55) (async)
setsockopt$bt_hci_HCI_TIME_STAMP(r8, 0x0, 0x3, &(0x7f0000000280)=0x9, 0x4) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x81])

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x2f}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x393e)

04:21:31 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x672c22)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000000)=""/105)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0x4, 0x672c22) (async)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000000)=""/105) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async)

04:21:31 executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080))
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000000)={0x5c08, 0x0, 0x5, 0x4, 0x9, 0x2})
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0) (async)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) (async)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000000)={0x5c08, 0x0, 0x5, 0x4, 0x9, 0x2}) (async)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x30}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x3e39)

04:21:31 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0xfffffffc])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
setsockopt$inet_dccp_int(r1, 0x21, 0xa, &(0x7f0000000000)=0x401, 0x4)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0xfffffffc]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
setsockopt$inet_dccp_int(r1, 0x21, 0xa, &(0x7f0000000000)=0x401, 0x4) (async)

04:21:31 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xc)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0})
clock_gettime(0x0, &(0x7f0000000200)={<r4=>0x0, <r5=>0x0})
clock_gettime(0x0, &(0x7f0000000240)={<r6=>0x0, <r7=>0x0})
write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{r6, r7/1000+60000}, 0x0, 0x9, 0x7ff}, {{}, 0x3, 0xb, 0x4}, {{r4, r5/1000+10000}, 0x3, 0x80, 0x8}, {{r2, r3/1000+60000}, 0x1f, 0x3, 0x1}, {{0x77359400}, 0x0, 0x0, 0x9}, {{0x77359400}, 0x11, 0x1000, 0xd80d}], 0x90)
r8 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x410003)
ioctl$EVIOCGABS2F(r8, 0x8018456f, &(0x7f00000001c0)=""/55)
setsockopt$bt_hci_HCI_TIME_STAMP(r8, 0x0, 0x3, &(0x7f0000000280)=0x9, 0x4)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x81])
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0xc) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
clock_gettime(0x0, &(0x7f0000000200)) (async)
clock_gettime(0x0, &(0x7f0000000240)) (async)
write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{r6, r7/1000+60000}, 0x0, 0x9, 0x7ff}, {{}, 0x3, 0xb, 0x4}, {{r4, r5/1000+10000}, 0x3, 0x80, 0x8}, {{r2, r3/1000+60000}, 0x1f, 0x3, 0x1}, {{0x77359400}, 0x0, 0x0, 0x9}, {{0x77359400}, 0x11, 0x1000, 0xd80d}], 0x90) (async)
syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x410003) (async)
ioctl$EVIOCGABS2F(r8, 0x8018456f, &(0x7f00000001c0)=""/55) (async)
setsockopt$bt_hci_HCI_TIME_STAMP(r8, 0x0, 0x3, &(0x7f0000000280)=0x9, 0x4) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000000)=[0x0, 0x81]) (async)

04:21:31 executing program 0:
setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r5 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8000000000000001, 0x4000)
write$P9_RWALK(r5, &(0x7f0000000200)={0x16, 0x6f, 0x1, {0x1, [{0x20, 0x3, 0x6}]}}, 0x16)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
getpeername$l2tp6(r4, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000180)=0x20)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:31 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9f, 0x22c000)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x31}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x6000)

04:21:31 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9f, 0x22c000)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x9f, 0x22c000) (async)

04:21:31 executing program 0:
setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r5 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8000000000000001, 0x4000)
write$P9_RWALK(r5, &(0x7f0000000200)={0x16, 0x6f, 0x1, {0x1, [{0x20, 0x3, 0x6}]}}, 0x16)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
getpeername$l2tp6(r4, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000180)=0x20)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x8000000000000001, 0x4000) (async)
write$P9_RWALK(r5, &(0x7f0000000200)={0x16, 0x6f, 0x1, {0x1, [{0x20, 0x3, 0x6}]}}, 0x16) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
getpeername$l2tp6(r4, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000180)=0x20) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:31 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0xfffffffc])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
setsockopt$inet_dccp_int(r1, 0x21, 0xa, &(0x7f0000000000)=0x401, 0x4)

04:21:31 executing program 3:
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x44880)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000180)=""/100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x32}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf000)

04:21:31 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9f, 0x22c000)

04:21:31 executing program 4:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0x3])
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000140)={0xe0fb, 0x5, 0xffffffff, 0x3, 0x2, 0x101})
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000000c0)=0x4)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/90)

04:21:31 executing program 0:
setsockopt$TIPC_MCAST_BROADCAST(0xffffffffffffffff, 0x10f, 0x85)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80) (async, rerun: 64)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (rerun: 64)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r5 = syz_open_dev$vcsa(&(0x7f00000001c0), 0x8000000000000001, 0x4000)
write$P9_RWALK(r5, &(0x7f0000000200)={0x16, 0x6f, 0x1, {0x1, [{0x20, 0x3, 0x6}]}}, 0x16)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
getpeername$l2tp6(r4, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000180)=0x20)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x33}, 0x0)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf0ffff)

04:21:31 executing program 3:
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x44880) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000180)=""/100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:31 executing program 4:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0x3])
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000140)={0xe0fb, 0x5, 0xffffffff, 0x3, 0x2, 0x101})
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000000c0)=0x4)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/90)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0x3]) (async)
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000140)={0xe0fb, 0x5, 0xffffffff, 0x3, 0x2, 0x101}) (async)
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000000c0)=0x4) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
pipe2$watch_queue(&(0x7f0000000100), 0x80) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/90) (async)

04:21:31 executing program 1:
setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000040)="060ba427f81d66d917d27ba7deed1bdc10553d35fb327d5642609cf53768afa7eda2ee3427731bcbfa2a20d7d9e2fe00c5960809bdc46c04a1c67f0296cc645244f6180a7829e8f8c8", 0x49)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x7f)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x34}, 0x0)

04:21:31 executing program 3:
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x44880)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000180)=""/100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x44880) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000180)=""/100) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x1000000)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x35}, 0x0)

04:21:31 executing program 4:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0x3]) (async, rerun: 64)
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f0000000140)={0xe0fb, 0x5, 0xffffffff, 0x3, 0x2, 0x101}) (async, rerun: 64)
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000000c0)=0x4) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/90)

04:21:31 executing program 1:
setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000040)="060ba427f81d66d917d27ba7deed1bdc10553d35fb327d5642609cf53768afa7eda2ee3427731bcbfa2a20d7d9e2fe00c5960809bdc46c04a1c67f0296cc645244f6180a7829e8f8c8", 0x49) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x7f)

04:21:31 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:31 executing program 3:
ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000100)=""/142)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000001c0)=""/201)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/28)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x2000000)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x36}, 0x0)

04:21:31 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000100)=""/161)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:31 executing program 1:
setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xd, &(0x7f0000000040)="060ba427f81d66d917d27ba7deed1bdc10553d35fb327d5642609cf53768afa7eda2ee3427731bcbfa2a20d7d9e2fe00c5960809bdc46c04a1c67f0296cc645244f6180a7829e8f8c8", 0x49) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x7f)

04:21:31 executing program 3:
ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000100)=""/142)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000001c0)=""/201)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/28)
ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000100)=""/142) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000001c0)=""/201) (async)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/28) (async)

04:21:31 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x3000000)

04:21:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x37}, 0x0)

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x320)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:32 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000100)=""/161) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x4000000)

04:21:32 executing program 3:
ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000100)=""/142)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000001c0)=""/201)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000000)=""/28)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x38}, 0x0)

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x320)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x320) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:32 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000100)=""/161) (async)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080))

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x7000000)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x39}, 0x0)

04:21:32 executing program 3:
sendto$l2tp6(0xffffffffffffffff, &(0x7f0000000000)="818e8c34943984c66cf635b8fb56ee196fdcb6a43934e628045cfc7322a1f0744c57b36b248434f2cc5bb11fe118e0ac4277a4545102279dcb5b22b51ae041dbf0ff6fb746b0798b515d3fa8aae153640281285b3343f0bc4e94b1cd4e", 0x5d, 0x4080, 0x0, 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1000000006, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000040)=0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x400c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0)
r3 = socket$l2tp(0x2, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080))

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x320)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x320) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x8000000)

04:21:32 executing program 3:
sendto$l2tp6(0xffffffffffffffff, &(0x7f0000000000)="818e8c34943984c66cf635b8fb56ee196fdcb6a43934e628045cfc7322a1f0744c57b36b248434f2cc5bb11fe118e0ac4277a4545102279dcb5b22b51ae041dbf0ff6fb746b0798b515d3fa8aae153640281285b3343f0bc4e94b1cd4e", 0x5d, 0x4080, 0x0, 0x0) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1000000006, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3a}, 0x0)

04:21:32 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x6, 0x4, 0xf0af, 0x101, "61b53042a1a6988517fd25b08a1f095e03e497ddcf4b619e23eb578f325c86ba"})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800, 0x2])

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000040)=0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x400c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0)
r3 = socket$l2tp(0x2, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080))
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
getpeername$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000040)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x400c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0) (async)
socket$l2tp(0x2, 0x2, 0x73) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080)) (async)

04:21:32 executing program 1:
r0 = socket(0xf, 0xa, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="100025bd7000fddbdf25000000e007001800ac1414bb08000b0002000000050014000400000008000b0000d00000000800110000000000140008007767320000000000000000000000000005002200000000"], 0x58}, 0x1, 0x0, 0x0, 0x20000004}, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3b}, 0x0)

04:21:32 executing program 3:
sendto$l2tp6(0xffffffffffffffff, &(0x7f0000000000)="818e8c34943984c66cf635b8fb56ee196fdcb6a43934e628045cfc7322a1f0744c57b36b248434f2cc5bb11fe118e0ac4277a4545102279dcb5b22b51ae041dbf0ff6fb746b0798b515d3fa8aae153640281285b3343f0bc4e94b1cd4e", 0x5d, 0x4080, 0x0, 0x0) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1000000006, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xe000000)

04:21:32 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x6, 0x4, 0xf0af, 0x101, "61b53042a1a6988517fd25b08a1f095e03e497ddcf4b619e23eb578f325c86ba"}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800, 0x2])

04:21:32 executing program 1:
r0 = socket(0xf, 0xa, 0x0) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="100025bd7000fddbdf25000000e007001800ac1414bb08000b0002000000050014000400000008000b0000d00000000800110000000000140008007767320000000000000000000000000005002200000000"], 0x58}, 0x1, 0x0, 0x0, 0x20000004}, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 32)
r1 = socket$l2tp6(0xa, 0x2, 0x73) (rerun: 32)
getpeername$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000040)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x400c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
openat$cgroup_procs(r2, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0)
r3 = socket$l2tp(0x2, 0x2, 0x73)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080))

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3c}, 0x0)

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf000000)

04:21:32 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x21, 0x15b802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 1:
r0 = socket(0xf, 0xa, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="100025bd7000fddbdf25000000e007001800ac1414bb08000b0002000000050014000400000008000b0000d00000000800110000000000140008007767320000000000000000000000000005002200000000"], 0x58}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) (async, rerun: 32)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (rerun: 32)

04:21:32 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x6, 0x4, 0xf0af, 0x101, "61b53042a1a6988517fd25b08a1f095e03e497ddcf4b619e23eb578f325c86ba"})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800, 0x2])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x6, 0x4, 0xf0af, 0x101, "61b53042a1a6988517fd25b08a1f095e03e497ddcf4b619e23eb578f325c86ba"}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800, 0x2]) (async)

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x3e390000)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3d}, 0x0)

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r1, 0x220, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c0c5}, 0x800)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x10)
pipe2$watch_queue(&(0x7f0000000100), 0x80)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r2, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40840}, 0x8080)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/194)

04:21:32 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x21, 0x15b802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xdfffffffffeffff3, 0x400)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
syz_open_dev$vcsa(&(0x7f0000000040), 0xfffffffffffffffb, 0x400)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x60000000)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x3e}, 0x0)

04:21:32 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/226)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:32 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x21, 0x15b802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xdfffffffffeffff3, 0x400) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
syz_open_dev$vcsa(&(0x7f0000000040), 0xfffffffffffffffb, 0x400)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r1, 0x220, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c0c5}, 0x800)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x10)
pipe2$watch_queue(&(0x7f0000000100), 0x80) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r2, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40840}, 0x8080) (async)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/194)

04:21:32 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x9effffff)

04:21:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x41}, 0x0)

04:21:32 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/226)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/226) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:32 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xdfffffffffeffff3, 0x400) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80)
syz_open_dev$vcsa(&(0x7f0000000040), 0xfffffffffffffffb, 0x400) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:32 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:32 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r1, 0x220, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c0c5}, 0x800) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x10) (async)
pipe2$watch_queue(&(0x7f0000000100), 0x80)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r2, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40840}, 0x8080) (async)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/194)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf0ffffff)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/226) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x42}, 0x0)

04:21:33 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async, rerun: 32)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7) (rerun: 32)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30}) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0) (async)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x80000000, 0x19b202)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x8, 0x7, 0x7f, 0x0, 0x6, 0x8})
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000b00)=""/4096)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xfffff000)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x464240)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, r2, 0x21}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x40, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x40}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x43}, 0x0)

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @rand_addr=0x64010100}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40041)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x80000000, 0x19b202)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x8, 0x7, 0x7f, 0x0, 0x6, 0x8})
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000b00)=""/4096)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xffffff7f)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x464240) (async)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, r2, 0x21}, 0x14}}, 0x0) (async)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x40, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x40}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @rand_addr=0x64010100}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40041) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:33 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0) (async)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0) (async)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x44}, 0x0)

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x80000000, 0x19b202) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000000)={0x8, 0x7, 0x7f, 0x0, 0x6, 0x8})
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000b00)=""/4096)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xffffff9e)

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @rand_addr=0x64010100}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40041)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x80, 0x464240) (async)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, r2, 0x21}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x40, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x40}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x45}, 0x0)

04:21:33 executing program 3:
write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x21, 0x2}, 0x7)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000000)=0x7)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xfffffff0)

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x5, 0x34, &(0x7f0000000000)="1b090562940b1728d9f6bd6bb1dcf5c2996f27ff877b715aecfb2a46eff2dd687203354be10b2023b43aeac60aab0fa61d4abc9f"})
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff, 0x20200)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$cgroup_pressure(r2, &(0x7f0000000140)={'some', 0x20, 0x8, 0x20, 0x8}, 0x2f)
ioctl$X86_IOC_RDMSR_REGS(r1, 0xc02063a0, &(0x7f0000000100)=[0xc8, 0x6c0, 0x3, 0x0, 0x16, 0x36298861, 0x918, 0xfffffffb])

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xa973, 0x40a000)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000180)={0x51, 0x40, 0x9f, {0x3ff, 0x200}, {0x8, 0x9ce8}, @period={0x5d, 0x7, 0x7ff, 0x74, 0x8, {0xfc00, 0xff, 0x7, 0x1}, 0x7, &(0x7f0000000040)=[0xcd17, 0xa8c, 0x8, 0xfff8, 0x9, 0xc908, 0x5]}})
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/100)

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x46}, 0x0)

04:21:33 executing program 3:
write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x21, 0x2}, 0x7)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000000)=0x7)
write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x21, 0x2}, 0x7) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000000)=0x7) (async)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf0ffffffffffff)

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x5, 0x34, &(0x7f0000000000)="1b090562940b1728d9f6bd6bb1dcf5c2996f27ff877b715aecfb2a46eff2dd687203354be10b2023b43aeac60aab0fa61d4abc9f"}) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff, 0x20200)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$cgroup_pressure(r2, &(0x7f0000000140)={'some', 0x20, 0x8, 0x20, 0x8}, 0x2f) (async)
ioctl$X86_IOC_RDMSR_REGS(r1, 0xc02063a0, &(0x7f0000000100)=[0xc8, 0x6c0, 0x3, 0x0, 0x16, 0x36298861, 0x918, 0xfffffffb])

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xa973, 0x40a000)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000180)={0x51, 0x40, 0x9f, {0x3ff, 0x200}, {0x8, 0x9ce8}, @period={0x5d, 0x7, 0x7ff, 0x74, 0x8, {0xfc00, 0xff, 0x7, 0x1}, 0x7, &(0x7f0000000040)=[0xcd17, 0xa8c, 0x8, 0xfff8, 0x9, 0xc908, 0x5]}})
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/100)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0xa973, 0x40a000) (async)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000180)={0x51, 0x40, 0x9f, {0x3ff, 0x200}, {0x8, 0x9ce8}, @period={0x5d, 0x7, 0x7ff, 0x74, 0x8, {0xfc00, 0xff, 0x7, 0x1}, 0x7, &(0x7f0000000040)=[0xcd17, 0xa8c, 0x8, 0xfff8, 0x9, 0xc908, 0x5]}}) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/100) (async)

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x47}, 0x0)

04:21:33 executing program 3:
write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x21, 0x2}, 0x7)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000000)=0x7)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x100000000000000)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xa973, 0x40a000)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000180)={0x51, 0x40, 0x9f, {0x3ff, 0x200}, {0x8, 0x9ce8}, @period={0x5d, 0x7, 0x7ff, 0x74, 0x8, {0xfc00, 0xff, 0x7, 0x1}, 0x7, &(0x7f0000000040)=[0xcd17, 0xa8c, 0x8, 0xfff8, 0x9, 0xc908, 0x5]}}) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/100)

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket(0x10, 0x3, 0x1) (async)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9}) (async)
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:33 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RREMOVE(r0, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x5, 0x34, &(0x7f0000000000)="1b090562940b1728d9f6bd6bb1dcf5c2996f27ff877b715aecfb2a46eff2dd687203354be10b2023b43aeac60aab0fa61d4abc9f"})
r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0xffff, 0x20200) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$cgroup_pressure(r2, &(0x7f0000000140)={'some', 0x20, 0x8, 0x20, 0x8}, 0x2f) (async)
ioctl$X86_IOC_RDMSR_REGS(r1, 0xc02063a0, &(0x7f0000000100)=[0xc8, 0x6c0, 0x3, 0x0, 0x16, 0x36298861, 0x918, 0xfffffffb])

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x200000000000000)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0xe6, 0xb44, 0x2, 0x5, 0x80000000, 0xd08})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0xf5, 0x1])
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x16])
ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x28100, 0x0)
ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"1e738293811c7cd8f57ac576f9c7cc8740bf2bf9022d69023dc730f90cba", 0x5, 0x20, 0x3, [0x8001, 0x970305ae, 0x221, 0x5, 0x1, 0x1, 0x9, 0x6, 0x0, 0x9b94, 0x78, 0x40, 0x40, 0x7fff, 0x8000, 0x384c, 0x101, 0xb635]})
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000040))

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x48}, 0x0)

04:21:33 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1, 0x0)
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x541b, &(0x7f0000000000)={'batadv0\x00', <r2=>0x0})
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r4 = syz_open_dev$evdev(&(0x7f0000000300), 0x6, 0x1000)
ioctl$EVIOCSABS0(r4, 0x401845c0, &(0x7f0000000340)={0x1ff, 0xcc, 0x2, 0x8, 0x7f, 0x1})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205)
ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000100)=""/180)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/147)
ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000000)={0x7ff, 0x3, 0x0, 0x3, 0x8, 0x4})
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)={'syztnl1\x00', r2, 0x4, 0x1c, 0x0, 0x0, 0x0, @mcast2, @private2, 0x1, 0x52ec6a0c3186cd78, 0x1, 0xfffffbff}})

04:21:33 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RREMOVE(r0, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RREMOVE(r0, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)

04:21:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x49}, 0x0)

04:21:33 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x300000000000000)

04:21:33 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9}) (async)
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:33 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0xe6, 0xb44, 0x2, 0x5, 0x80000000, 0xd08})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 64)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0xf5, 0x1]) (async, rerun: 64)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x16])
ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x28100, 0x0)
ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"1e738293811c7cd8f57ac576f9c7cc8740bf2bf9022d69023dc730f90cba", 0x5, 0x20, 0x3, [0x8001, 0x970305ae, 0x221, 0x5, 0x1, 0x1, 0x9, 0x6, 0x0, 0x9b94, 0x78, 0x40, 0x40, 0x7fff, 0x8000, 0x384c, 0x101, 0xb635]}) (async)
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000040))

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4a}, 0x0)

04:21:34 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RREMOVE(r0, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x400000000000000)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1, 0x0)
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x541b, &(0x7f0000000000)={'batadv0\x00', <r2=>0x0})
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r4 = syz_open_dev$evdev(&(0x7f0000000300), 0x6, 0x1000)
ioctl$EVIOCSABS0(r4, 0x401845c0, &(0x7f0000000340)={0x1ff, 0xcc, 0x2, 0x8, 0x7f, 0x1})
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205)
ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000100)=""/180)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/147)
ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000000)={0x7ff, 0x3, 0x0, 0x3, 0x8, 0x4})
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)={'syztnl1\x00', r2, 0x4, 0x1c, 0x0, 0x0, 0x0, @mcast2, @private2, 0x1, 0x52ec6a0c3186cd78, 0x1, 0xfffffbff}})
syz_open_dev$evdev(&(0x7f00000000c0), 0x1, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000040), 0x80) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x541b, &(0x7f0000000000)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_open_dev$evdev(&(0x7f0000000300), 0x6, 0x1000) (async)
ioctl$EVIOCSABS0(r4, 0x401845c0, &(0x7f0000000340)={0x1ff, 0xcc, 0x2, 0x8, 0x7f, 0x1}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205) (async)
ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000100)=""/180) (async)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/147) (async)
ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000000)={0x7ff, 0x3, 0x0, 0x3, 0x8, 0x4}) (async)
socket$inet6_udp(0xa, 0x2, 0x0) (async)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)={'syztnl1\x00', r2, 0x4, 0x1c, 0x0, 0x0, 0x0, @mcast2, @private2, 0x1, 0x52ec6a0c3186cd78, 0x1, 0xfffffbff}}) (async)

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0xe6, 0xb44, 0x2, 0x5, 0x80000000, 0xd08})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=[0xf5, 0x1]) (async)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x16]) (async)
ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x28100, 0x0)
ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"1e738293811c7cd8f57ac576f9c7cc8740bf2bf9022d69023dc730f90cba", 0x5, 0x20, 0x3, [0x8001, 0x970305ae, 0x221, 0x5, 0x1, 0x1, 0x9, 0x6, 0x0, 0x9b94, 0x78, 0x40, 0x40, 0x7fff, 0x8000, 0x384c, 0x101, 0xb635]})
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000040))

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4b}, 0x0)

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x700000000000000)

04:21:34 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/26)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x5, 0x80000000])

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000100), &(0x7f0000000140)=0x4)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f0000000000)=""/152)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/226)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x1, 0x0)
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x541b, &(0x7f0000000000)={'batadv0\x00', <r2=>0x0}) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
r4 = syz_open_dev$evdev(&(0x7f0000000300), 0x6, 0x1000)
ioctl$EVIOCSABS0(r4, 0x401845c0, &(0x7f0000000340)={0x1ff, 0xcc, 0x2, 0x8, 0x7f, 0x1}) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205) (async, rerun: 32)
ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000100)=""/180) (async, rerun: 32)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000240)=""/147) (async)
ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000000)={0x7ff, 0x3, 0x0, 0x3, 0x8, 0x4}) (async)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r5, 0x89f6, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)={'syztnl1\x00', r2, 0x4, 0x1c, 0x0, 0x0, 0x0, @mcast2, @private2, 0x1, 0x52ec6a0c3186cd78, 0x1, 0xfffffbff}})

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0xffffffff, 0x80000001, 0x6, 0x28ca, 0x8, 0x5cec})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x800000000000000)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000100), &(0x7f0000000140)=0x4)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f0000000000)=""/152) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/226)

04:21:34 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/26)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x5, 0x80000000])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/26) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x5, 0x80000000]) (async)

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4c}, 0x0)

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xe00000000000000)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7fff, 0xfd47e5dd751567d9)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0x4, 0xa1, &(0x7f0000000080)="01fa0c69b93826df9bf3590133b4f802084ac88b343719a7179a4e5e9a5d99ec7fae50251844da0d72b1395502fce07d2506ab0f21996183a95af052077e18d4b5a7c8cb2285f1611c4e73bb7a1b84a96a84e15d7819a7dccb04fc567730fd627872527341bc344fa5624714f172db7860143e5f72232bcf7ff36fe32e7fa1c23c85d3ecf8b852160b24f0c6679aa37b09f616867a00b3a5eb1814a3fcba6739fb"})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000140)=""/159)

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0xffffffff, 0x80000001, 0x6, 0x28ca, 0x8, 0x5cec})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0xffffffff, 0x80000001, 0x6, 0x28ca, 0x8, 0x5cec}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:34 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000000)=""/26)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x5, 0x80000000])

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf00000000000000)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000100), &(0x7f0000000140)=0x4)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f0000000000)=""/152)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/226)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
pipe2$watch_queue(&(0x7f00000000c0), 0x80) (async)
getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f0000000000)=""/152) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000340)=""/226) (async)

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4d}, 0x0)

04:21:34 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc0399b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x58a9000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', <r2=>0x0, 0x2f, 0x0, 0x44, 0x3aa, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8000, 0x7800, 0x3, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x4, 0x20, 0x6, 0x7, 0x12, @ipv4={'\x00', '\xff\xff', @multicast1}, @private0, 0x8, 0x7800, 0x0, 0x338}})
r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r3, 0xc0189436, &(0x7f0000000080))

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0xffffffff, 0x80000001, 0x6, 0x28ca, 0x8, 0x5cec}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7fff, 0xfd47e5dd751567d9)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0x4, 0xa1, &(0x7f0000000080)="01fa0c69b93826df9bf3590133b4f802084ac88b343719a7179a4e5e9a5d99ec7fae50251844da0d72b1395502fce07d2506ab0f21996183a95af052077e18d4b5a7c8cb2285f1611c4e73bb7a1b84a96a84e15d7819a7dccb04fc567730fd627872527341bc344fa5624714f172db7860143e5f72232bcf7ff36fe32e7fa1c23c85d3ecf8b852160b24f0c6679aa37b09f616867a00b3a5eb1814a3fcba6739fb"}) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000140)=""/159)

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4e}, 0x0)

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x3e39000000000000)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10)

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x6000000000000000)

04:21:34 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc0399b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x58a9000) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', <r2=>0x0, 0x2f, 0x0, 0x44, 0x3aa, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8000, 0x7800, 0x3, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x4, 0x20, 0x6, 0x7, 0x12, @ipv4={'\x00', '\xff\xff', @multicast1}, @private0, 0x8, 0x7800, 0x0, 0x338}}) (async)
r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r3, 0xc0189436, &(0x7f0000000080))

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x4f}, 0x0)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7fff, 0xfd47e5dd751567d9)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0x4, 0xa1, &(0x7f0000000080)="01fa0c69b93826df9bf3590133b4f802084ac88b343719a7179a4e5e9a5d99ec7fae50251844da0d72b1395502fce07d2506ab0f21996183a95af052077e18d4b5a7c8cb2285f1611c4e73bb7a1b84a96a84e15d7819a7dccb04fc567730fd627872527341bc344fa5624714f172db7860143e5f72232bcf7ff36fe32e7fa1c23c85d3ecf8b852160b24f0c6679aa37b09f616867a00b3a5eb1814a3fcba6739fb"}) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000140)=""/159)

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xf4, 0x1, 0x81, 0x8, 0x80000000, 0x1})
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x181000)
ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/90)
write$P9_RWALK(r1, &(0x7f0000000180)={0x57, 0x6f, 0x2, {0x6, [{0x10, 0x1, 0x7}, {0x40, 0x0, 0x6}, {0x20, 0x0, 0x1}, {0x4, 0x0, 0x5}, {0x0, 0x4, 0x6}, {0x4, 0x3, 0x1}]}}, 0x57)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000000)={&(0x7f0000000100)={{@host, 0xffff}, {@hyper, 0x4}, 0x400, "21f447fdcb4c859603357d9382bbb1e2046eb095fb6c368ce82c06b6da20afa66272745e152efdf2b02d8a9aae6b6970e11f409b12d5bdaff8032a01420a4b46f5eeadca2f79ef53d32f0aad3a63f2d4f763298066f45d269a64747149e1a34b6ece3b510209be13e7acb9908510625b73b5b0ca188e44698e3731e2e257a252c96d0d0b91ec009261a74f7b261102be54b88c230bf8f42d27a4e1677684127783cfde68dcaf0d74d644a265017284d6cf6a41e6e70d034ea77e75638d8acbe5e8c164cbd09a085a24326a34dba6871b56cb885d811524c04ccc56077f5fd5233d8a8f40b6e73bcc27b3f2a2d7c03db6e7a9335822e4fcdee2d7e69c9785f3a635075916e4dece9583514113314e6d170b53bdf0443507b5f319bd6c4fb2f123c772dd48c3967d5488a169bd1269f8668bc5299f065cd2c010d585863b9184f0eb90959d5564e5a2a4ca1edc78c528960c70be52280d6260843ed4437b927b7d5dea9d5fa49d0f220eb5b87ead721228726367de1dd9b244423ad6be3c920323bf49ec8dcc7bbd9430833abc36e1143c5371203147d8059bd9fd3de598a04abaea839a49a44883804c064be31e4de62cd3507871ab6da592540f1a2aadc602925aa5b6d307cec9d29715b1d8308b4af3a8bb18307ace4eab12ac01e322ad4de5e6d79c0dc72b00a3694e8a59daabede97b534f79a2aff5010d76448de8cefc4139fedc2ebcc0c466c981dd5dc771078a8574e57fd67c20d3fc3420f3b7326535f1b9f1f3da6c695a4959c0d0dd5d3e3ca12c1245b0a17549486be73b844c89e65006b7eaff05e07bf802d6dc359aadf0fb420915741cd16e432ee966f40c56498b546e899eada4659502d157fe2c7580eb0e7f98cbda2af74f146c939f5d18749be6c27c0c1bcb6272cdd48429a602e44200e5fe628a2ab5985b847dc782280a2b013c50aa362bd9cbe3aa78488b75421d1403013d026e1de4c07894c4c29955fb0ea27b7b6a818d3f0d9f9f3a102275470b6fcf624b385709c8f8942fd3de1361b6c7a91c7b60b052622727f5246ba29d72faa706bb5927474bb601dded2270b859bb2c28af24cb45afdc45ff6da4cbab7be5c33bbf0e6ce53ee46be89356ef4ce940b519dfd744066769fb9a3e4dbc017a177308fe2db5279f61402fb3817cc7316dc82deb6d9cfd3b0dbefcc202718f845edacffbe4c353de9e6e622840e3f75558eef343b154bf84421ab46223629c4845b2bea662977f526e210af0503cf3c857432f492eb299b9d17efd97c4a33ac586c9d9dfdcdb38f7530f16ae96ee75d89d3b63482ccf80b738fd42ef19357be953645e0c96b017a027260bc408d32cba73a79f4d247dd29d3f2607d7eb0cb863edbf542eafc3c715ccdc313e33e2bf33983c4a1fe069da44852f754410328581e70e8122163aad9047c0c840de56"}, 0x418, 0x2})

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x9effffff00000000)

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x50}, 0x0)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xf4, 0x1, 0x81, 0x8, 0x80000000, 0x1})
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x181000)
ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/90) (async)
write$P9_RWALK(r1, &(0x7f0000000180)={0x57, 0x6f, 0x2, {0x6, [{0x10, 0x1, 0x7}, {0x40, 0x0, 0x6}, {0x20, 0x0, 0x1}, {0x4, 0x0, 0x5}, {0x0, 0x4, 0x6}, {0x4, 0x3, 0x1}]}}, 0x57) (async)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:34 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc0399b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x58a9000) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', <r2=>0x0, 0x2f, 0x0, 0x44, 0x3aa, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8000, 0x7800, 0x3, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x4, 0x20, 0x6, 0x7, 0x12, @ipv4={'\x00', '\xff\xff', @multicast1}, @private0, 0x8, 0x7800, 0x0, 0x338}}) (async)
r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r3, 0xc0189436, &(0x7f0000000080))

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xf0ffffff00000000)

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x51}, 0x0)

04:21:34 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20001814}, 0x0)

04:21:34 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xf4, 0x1, 0x81, 0x8, 0x80000000, 0x1}) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x181000)
ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/90) (async)
write$P9_RWALK(r1, &(0x7f0000000180)={0x57, 0x6f, 0x2, {0x6, [{0x10, 0x1, 0x7}, {0x40, 0x0, 0x6}, {0x20, 0x0, 0x1}, {0x4, 0x0, 0x5}, {0x0, 0x4, 0x6}, {0x4, 0x3, 0x1}]}}, 0x57) (async)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:34 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000000)={&(0x7f0000000100)={{@host, 0xffff}, {@hyper, 0x4}, 0x400, "21f447fdcb4c859603357d9382bbb1e2046eb095fb6c368ce82c06b6da20afa66272745e152efdf2b02d8a9aae6b6970e11f409b12d5bdaff8032a01420a4b46f5eeadca2f79ef53d32f0aad3a63f2d4f763298066f45d269a64747149e1a34b6ece3b510209be13e7acb9908510625b73b5b0ca188e44698e3731e2e257a252c96d0d0b91ec009261a74f7b261102be54b88c230bf8f42d27a4e1677684127783cfde68dcaf0d74d644a265017284d6cf6a41e6e70d034ea77e75638d8acbe5e8c164cbd09a085a24326a34dba6871b56cb885d811524c04ccc56077f5fd5233d8a8f40b6e73bcc27b3f2a2d7c03db6e7a9335822e4fcdee2d7e69c9785f3a635075916e4dece9583514113314e6d170b53bdf0443507b5f319bd6c4fb2f123c772dd48c3967d5488a169bd1269f8668bc5299f065cd2c010d585863b9184f0eb90959d5564e5a2a4ca1edc78c528960c70be52280d6260843ed4437b927b7d5dea9d5fa49d0f220eb5b87ead721228726367de1dd9b244423ad6be3c920323bf49ec8dcc7bbd9430833abc36e1143c5371203147d8059bd9fd3de598a04abaea839a49a44883804c064be31e4de62cd3507871ab6da592540f1a2aadc602925aa5b6d307cec9d29715b1d8308b4af3a8bb18307ace4eab12ac01e322ad4de5e6d79c0dc72b00a3694e8a59daabede97b534f79a2aff5010d76448de8cefc4139fedc2ebcc0c466c981dd5dc771078a8574e57fd67c20d3fc3420f3b7326535f1b9f1f3da6c695a4959c0d0dd5d3e3ca12c1245b0a17549486be73b844c89e65006b7eaff05e07bf802d6dc359aadf0fb420915741cd16e432ee966f40c56498b546e899eada4659502d157fe2c7580eb0e7f98cbda2af74f146c939f5d18749be6c27c0c1bcb6272cdd48429a602e44200e5fe628a2ab5985b847dc782280a2b013c50aa362bd9cbe3aa78488b75421d1403013d026e1de4c07894c4c29955fb0ea27b7b6a818d3f0d9f9f3a102275470b6fcf624b385709c8f8942fd3de1361b6c7a91c7b60b052622727f5246ba29d72faa706bb5927474bb601dded2270b859bb2c28af24cb45afdc45ff6da4cbab7be5c33bbf0e6ce53ee46be89356ef4ce940b519dfd744066769fb9a3e4dbc017a177308fe2db5279f61402fb3817cc7316dc82deb6d9cfd3b0dbefcc202718f845edacffbe4c353de9e6e622840e3f75558eef343b154bf84421ab46223629c4845b2bea662977f526e210af0503cf3c857432f492eb299b9d17efd97c4a33ac586c9d9dfdcdb38f7530f16ae96ee75d89d3b63482ccf80b738fd42ef19357be953645e0c96b017a027260bc408d32cba73a79f4d247dd29d3f2607d7eb0cb863edbf542eafc3c715ccdc313e33e2bf33983c4a1fe069da44852f754410328581e70e8122163aad9047c0c840de56"}, 0x418, 0x2})

04:21:34 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x5, 0x100])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x28801)
write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0x6000, 0x8000}, {{}, 0x2, 0x5, 0x8}, {{}, 0x0, 0xff, 0x94f}, {{}, 0x5, 0x3, 0x80}, {{0x0, 0xea60}, 0x16, 0xffff, 0xa00}, {{0x0, 0x2710}, 0x0, 0x1000, 0x12001}, {{0x77359400}, 0x11, 0x100, 0x1}, {{0x0, 0x2710}, 0x16, 0x3, 0x703d}, {{0x77359400}, 0x2, 0x3, 0xffffffff}, {{}, 0x4, 0x4, 0x7}], 0xf0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x52}, 0x0)

04:21:34 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xffffff7f00000000)

04:21:35 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000000)={&(0x7f0000000100)={{@host, 0xffff}, {@hyper, 0x4}, 0x400, "21f447fdcb4c859603357d9382bbb1e2046eb095fb6c368ce82c06b6da20afa66272745e152efdf2b02d8a9aae6b6970e11f409b12d5bdaff8032a01420a4b46f5eeadca2f79ef53d32f0aad3a63f2d4f763298066f45d269a64747149e1a34b6ece3b510209be13e7acb9908510625b73b5b0ca188e44698e3731e2e257a252c96d0d0b91ec009261a74f7b261102be54b88c230bf8f42d27a4e1677684127783cfde68dcaf0d74d644a265017284d6cf6a41e6e70d034ea77e75638d8acbe5e8c164cbd09a085a24326a34dba6871b56cb885d811524c04ccc56077f5fd5233d8a8f40b6e73bcc27b3f2a2d7c03db6e7a9335822e4fcdee2d7e69c9785f3a635075916e4dece9583514113314e6d170b53bdf0443507b5f319bd6c4fb2f123c772dd48c3967d5488a169bd1269f8668bc5299f065cd2c010d585863b9184f0eb90959d5564e5a2a4ca1edc78c528960c70be52280d6260843ed4437b927b7d5dea9d5fa49d0f220eb5b87ead721228726367de1dd9b244423ad6be3c920323bf49ec8dcc7bbd9430833abc36e1143c5371203147d8059bd9fd3de598a04abaea839a49a44883804c064be31e4de62cd3507871ab6da592540f1a2aadc602925aa5b6d307cec9d29715b1d8308b4af3a8bb18307ace4eab12ac01e322ad4de5e6d79c0dc72b00a3694e8a59daabede97b534f79a2aff5010d76448de8cefc4139fedc2ebcc0c466c981dd5dc771078a8574e57fd67c20d3fc3420f3b7326535f1b9f1f3da6c695a4959c0d0dd5d3e3ca12c1245b0a17549486be73b844c89e65006b7eaff05e07bf802d6dc359aadf0fb420915741cd16e432ee966f40c56498b546e899eada4659502d157fe2c7580eb0e7f98cbda2af74f146c939f5d18749be6c27c0c1bcb6272cdd48429a602e44200e5fe628a2ab5985b847dc782280a2b013c50aa362bd9cbe3aa78488b75421d1403013d026e1de4c07894c4c29955fb0ea27b7b6a818d3f0d9f9f3a102275470b6fcf624b385709c8f8942fd3de1361b6c7a91c7b60b052622727f5246ba29d72faa706bb5927474bb601dded2270b859bb2c28af24cb45afdc45ff6da4cbab7be5c33bbf0e6ce53ee46be89356ef4ce940b519dfd744066769fb9a3e4dbc017a177308fe2db5279f61402fb3817cc7316dc82deb6d9cfd3b0dbefcc202718f845edacffbe4c353de9e6e622840e3f75558eef343b154bf84421ab46223629c4845b2bea662977f526e210af0503cf3c857432f492eb299b9d17efd97c4a33ac586c9d9dfdcdb38f7530f16ae96ee75d89d3b63482ccf80b738fd42ef19357be953645e0c96b017a027260bc408d32cba73a79f4d247dd29d3f2607d7eb0cb863edbf542eafc3c715ccdc313e33e2bf33983c4a1fe069da44852f754410328581e70e8122163aad9047c0c840de56"}, 0x418, 0x2})

04:21:35 executing program 4:
syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x60a41)

04:21:35 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x5, 0x100])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x28801)
write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0x6000, 0x8000}, {{}, 0x2, 0x5, 0x8}, {{}, 0x0, 0xff, 0x94f}, {{}, 0x5, 0x3, 0x80}, {{0x0, 0xea60}, 0x16, 0xffff, 0xa00}, {{0x0, 0x2710}, 0x0, 0x1000, 0x12001}, {{0x77359400}, 0x11, 0x100, 0x1}, {{0x0, 0x2710}, 0x16, 0x3, 0x703d}, {{0x77359400}, 0x2, 0x3, 0xffffffff}, {{}, 0x4, 0x4, 0x7}], 0xf0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x5, 0x100]) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x28801) (async)
write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0x6000, 0x8000}, {{}, 0x2, 0x5, 0x8}, {{}, 0x0, 0xff, 0x94f}, {{}, 0x5, 0x3, 0x80}, {{0x0, 0xea60}, 0x16, 0xffff, 0xa00}, {{0x0, 0x2710}, 0x0, 0x1000, 0x12001}, {{0x77359400}, 0x11, 0x100, 0x1}, {{0x0, 0x2710}, 0x16, 0x3, 0x703d}, {{0x77359400}, 0x2, 0x3, 0xffffffff}, {{}, 0x4, 0x4, 0x7}], 0xf0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:35 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20001814}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20001814}, 0x0) (async)

04:21:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x53}, 0x0)

04:21:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xffffffff00000000)

04:21:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0xfffffffffffff000)

04:21:35 executing program 4:
syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x60a41)

04:21:35 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x9, 0x40000)
ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000040), &(0x7f0000000080)=""/23, 0x17})

04:21:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x54}, 0x0)

04:21:35 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20001814}, 0x0)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20001814}, 0x0) (async)

04:21:35 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x5, 0x100])
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x28801)
write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0x6000, 0x8000}, {{}, 0x2, 0x5, 0x8}, {{}, 0x0, 0xff, 0x94f}, {{}, 0x5, 0x3, 0x80}, {{0x0, 0xea60}, 0x16, 0xffff, 0xa00}, {{0x0, 0x2710}, 0x0, 0x1000, 0x12001}, {{0x77359400}, 0x11, 0x100, 0x1}, {{0x0, 0x2710}, 0x16, 0x3, 0x703d}, {{0x77359400}, 0x2, 0x3, 0xffffffff}, {{}, 0x4, 0x4, 0x7}], 0xf0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x5, 0x100]) (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x28801) (async)
write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0x6000, 0x8000}, {{}, 0x2, 0x5, 0x8}, {{}, 0x0, 0xff, 0x94f}, {{}, 0x5, 0x3, 0x80}, {{0x0, 0xea60}, 0x16, 0xffff, 0xa00}, {{0x0, 0x2710}, 0x0, 0x1000, 0x12001}, {{0x77359400}, 0x11, 0x100, 0x1}, {{0x0, 0x2710}, 0x16, 0x3, 0x703d}, {{0x77359400}, 0x2, 0x3, 0xffffffff}, {{}, 0x4, 0x4, 0x7}], 0xf0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:35 executing program 4:
syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x60a41)
syz_open_dev$evdev(&(0x7f0000000000), 0xffffffffffffffff, 0x60a41) (async)

04:21:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400844}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r2, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0xfff9}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x58}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wlan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x2000c000)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000))

04:21:35 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x0, 0x3, {0x401, 0x10}, {0x5, 0x400}, @rumble={0x0, 0xff}})

04:21:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x55}, 0x0)

04:21:35 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x1, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:35 executing program 4:
ioctl$EVIOCSABS2F(0xffffffffffffffff, 0x401845ef, &(0x7f0000000040)={0x698, 0x6, 0x2f24, 0xfffffe00, 0xfff, 0x1})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0x1, 0x4, 0x1, 0x9, 0x8, 0x4})
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/252)
geteuid()

04:21:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400844}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r2, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0xfff9}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x58}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wlan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x2000c000) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000))

04:21:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x56}, 0x0)

04:21:36 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x9, 0x40000)
ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000040), &(0x7f0000000080)=""/23, 0x17})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$usbmon(&(0x7f0000000000), 0x9, 0x40000) (async)
ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000040), &(0x7f0000000080)=""/23, 0x17}) (async)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x0, 0x3, {0x401, 0x10}, {0x5, 0x400}, @rumble={0x0, 0xff}})

04:21:36 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x1, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x57}, 0x0)

04:21:36 executing program 4:
ioctl$EVIOCSABS2F(0xffffffffffffffff, 0x401845ef, &(0x7f0000000040)={0x698, 0x6, 0x2f24, 0xfffffe00, 0xfff, 0x1}) (async, rerun: 32)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (rerun: 32)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0x1, 0x4, 0x1, 0x9, 0x8, 0x4}) (async, rerun: 32)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/252) (async, rerun: 32)
geteuid()

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400844}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r2, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0xfff9}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x58}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wlan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x2000c000) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000))

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x0, 0x3, {0x401, 0x10}, {0x5, 0x400}, @rumble={0x0, 0xff}})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x55, 0x0, 0x3, {0x401, 0x10}, {0x5, 0x400}, @rumble={0x0, 0xff}}) (async)

04:21:36 executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x1, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$inet_udp(0x2, 0x2, 0x0) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x1, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x58}, 0x0)

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x202000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r1, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:36 executing program 4:
ioctl$EVIOCSABS2F(0xffffffffffffffff, 0x401845ef, &(0x7f0000000040)={0x698, 0x6, 0x2f24, 0xfffffe00, 0xfff, 0x1})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0x1, 0x4, 0x1, 0x9, 0x8, 0x4}) (async)
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000100)=""/252) (async)
geteuid()

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048855}, 0x840)
getpeername$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xffffffff}, 0x20)

04:21:36 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x9, 0x40000)
ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000040), &(0x7f0000000080)=""/23, 0x17})
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$usbmon(&(0x7f0000000000), 0x9, 0x40000) (async)
ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000040), &(0x7f0000000080)=""/23, 0x17}) (async)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x59}, 0x0)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x403, 0x2985c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2000000])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000040)={0x3, 0xd0, &(0x7f00000000c0)="9290a2fa66cb4e326ffec2ef02e9aedc051e3b931b871bc0cfc5e0206050ec3527ae9657899270fbfb6cbcba2581bb7e49bcbab5e4b5c5b43a0cec79d10ad8870e6d8c04f8831780fac7a7d6af90c81dc8153b27b7b4293b3c8441b4feae04701ea6d7356f817da4cf55e775f69d574012b94e0c08e773b2969688617278bde5556eede55607390f89a07d47804286fe8f8977b4bcba40641920afb35d07202790d71f0afbc6ee8fa26c51e7bc980b5f8f733fa5886209ce9a3954284203e1e1920ba7adf1d4de1536abb834f90191e1"})

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x202000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r1, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40000) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:36 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f00000000c0)=""/120)

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048855}, 0x840)
getpeername$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xffffffff}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048855}, 0x840) (async)
getpeername$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xffffffff}, 0x20) (async)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5a}, 0x0)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x403, 0x2985c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2000000]) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000040)={0x3, 0xd0, &(0x7f00000000c0)="9290a2fa66cb4e326ffec2ef02e9aedc051e3b931b871bc0cfc5e0206050ec3527ae9657899270fbfb6cbcba2581bb7e49bcbab5e4b5c5b43a0cec79d10ad8870e6d8c04f8831780fac7a7d6af90c81dc8153b27b7b4293b3c8441b4feae04701ea6d7356f817da4cf55e775f69d574012b94e0c08e773b2969688617278bde5556eede55607390f89a07d47804286fe8f8977b4bcba40641920afb35d07202790d71f0afbc6ee8fa26c51e7bc980b5f8f733fa5886209ce9a3954284203e1e1920ba7adf1d4de1536abb834f90191e1"})

04:21:36 executing program 1:
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x1)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000180)={0x1ff, 0x8, 0x9, 0x100, 0x1, 0x40000400})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
pipe2$watch_queue(&(0x7f0000000140), 0x80)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0003257d15e32cc35be530f05f52b35ddbdf2504bc1d92d813a170ee89b60005001200fb00000006001c01f104000f0500040008000000f2929fcc143bd570db2b5ce589b9073af1ca095bf0c89933b19b9cd111e757b4"], 0x34}, 0x1, 0x0, 0x0, 0x2884}, 0x50)
getrusage(0xffffffffffffffff, &(0x7f0000000300))
bind$l2tp6(r3, &(0x7f0000000100)={0xa, 0x0, 0x6, @private2, 0x6, 0x2}, 0x20)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000080)={{@my=0x1, 0x6}, 0x0, 0x1, 0x2})
r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r6, 0x541b, 0x0)
ioctl$EVIOCGRAB(r6, 0x40044590, &(0x7f0000000000)=0x6)

04:21:36 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f00000000c0)=""/120)

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048855}, 0x840)
getpeername$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xffffffff}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048855}, 0x840) (async)
getpeername$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0xffffffff}, 0x20) (async)

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x202000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, r1, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x40000)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5b}, 0x0)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x403, 0x2985c2)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x0, 0x2000000]) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000040)={0x3, 0xd0, &(0x7f00000000c0)="9290a2fa66cb4e326ffec2ef02e9aedc051e3b931b871bc0cfc5e0206050ec3527ae9657899270fbfb6cbcba2581bb7e49bcbab5e4b5c5b43a0cec79d10ad8870e6d8c04f8831780fac7a7d6af90c81dc8153b27b7b4293b3c8441b4feae04701ea6d7356f817da4cf55e775f69d574012b94e0c08e773b2969688617278bde5556eede55607390f89a07d47804286fe8f8977b4bcba40641920afb35d07202790d71f0afbc6ee8fa26c51e7bc980b5f8f733fa5886209ce9a3954284203e1e1920ba7adf1d4de1536abb834f90191e1"})

04:21:36 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f00000000c0)=""/120)

04:21:36 executing program 1:
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x1)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000180)={0x1ff, 0x8, 0x9, 0x100, 0x1, 0x40000400})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80) (async)
pipe2$watch_queue(&(0x7f0000000140), 0x80) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004000) (async)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0003257d15e32cc35be530f05f52b35ddbdf2504bc1d92d813a170ee89b60005001200fb00000006001c01f104000f0500040008000000f2929fcc143bd570db2b5ce589b9073af1ca095bf0c89933b19b9cd111e757b4"], 0x34}, 0x1, 0x0, 0x0, 0x2884}, 0x50)
getrusage(0xffffffffffffffff, &(0x7f0000000300)) (async)
bind$l2tp6(r3, &(0x7f0000000100)={0xa, 0x0, 0x6, @private2, 0x6, 0x2}, 0x20)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000080)={{@my=0x1, 0x6}, 0x0, 0x1, 0x2}) (async)
r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r6, 0x541b, 0x0)
ioctl$EVIOCGRAB(r6, 0x40044590, &(0x7f0000000000)=0x6)

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7736}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000880)

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082bbd7000fedbdf25040000000800f03512585ed672681900640101000c0016000700000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x1)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendto$l2tp6(r0, 0x0, 0xffffff24, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x7, 0xfffffffe}, 0x20)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5c}, 0x0)

04:21:36 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x7ff])

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7736}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000880)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7736}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000880) (async)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000100)=""/148)

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082bbd7000fedbdf25040000000800f03512585ed672681900640101000c0016000700000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async, rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) (rerun: 64)
sendto$l2tp6(r0, 0x0, 0xffffff24, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x7, 0xfffffffe}, 0x20)

04:21:36 executing program 1:
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x1)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000180)={0x1ff, 0x8, 0x9, 0x100, 0x1, 0x40000400})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
pipe2$watch_queue(&(0x7f0000000140), 0x80)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0003257d15e32cc35be530f05f52b35ddbdf2504bc1d92d813a170ee89b60005001200fb00000006001c01f104000f0500040008000000f2929fcc143bd570db2b5ce589b9073af1ca095bf0c89933b19b9cd111e757b4"], 0x34}, 0x1, 0x0, 0x0, 0x2884}, 0x50)
getrusage(0xffffffffffffffff, &(0x7f0000000300))
bind$l2tp6(r3, &(0x7f0000000100)={0xa, 0x0, 0x6, @private2, 0x6, 0x2}, 0x20)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000080)={{@my=0x1, 0x6}, 0x0, 0x1, 0x2})
r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r6, 0x541b, 0x0)
ioctl$EVIOCGRAB(r6, 0x40044590, &(0x7f0000000000)=0x6)
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000180)={0x1ff, 0x8, 0x9, 0x100, 0x1, 0x40000400}) (async)
pipe2$watch_queue(&(0x7f0000000040), 0x80) (async)
pipe2$watch_queue(&(0x7f0000000140), 0x80) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004000) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0003257d15e32cc35be530f05f52b35ddbdf2504bc1d92d813a170ee89b60005001200fb00000006001c01f104000f0500040008000000f2929fcc143bd570db2b5ce589b9073af1ca095bf0c89933b19b9cd111e757b4"], 0x34}, 0x1, 0x0, 0x0, 0x2884}, 0x50) (async)
getrusage(0xffffffffffffffff, &(0x7f0000000300)) (async)
bind$l2tp6(r3, &(0x7f0000000100)={0xa, 0x0, 0x6, @private2, 0x6, 0x2}, 0x20) (async)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000080)={{@my=0x1, 0x6}, 0x0, 0x1, 0x2}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r6, 0x541b, 0x0) (async)
ioctl$EVIOCGRAB(r6, 0x40044590, &(0x7f0000000000)=0x6) (async)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5d}, 0x0)

04:21:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async, rerun: 32)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x81}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7736}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000880) (rerun: 32)

04:21:36 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x7ff])
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x7ff]) (async)

04:21:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5e}, 0x0)

04:21:36 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000100)=""/148)

04:21:36 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082bbd7000fedbdf25040000000800f03512585ed672681900640101000c0016000700000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x1)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async)
sendto$l2tp6(r0, 0x0, 0xffffff24, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x7, 0xfffffffe}, 0x20)

04:21:36 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/205)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000100)=""/148)

04:21:37 executing program 4:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x7ff])

04:21:37 executing program 5:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x8}, 0x4}}, 0x18)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/168)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x3}, 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c1)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x26, 0x4, 0x800)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x23}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20000011)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x5f}, 0x0)

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/205)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/205) (async)

04:21:37 executing program 4:
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000100)={@hyper, 0x7fffffff})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xfffffffffffffffa, 0x800, 0x9, 0x9, 0x80000000, 0x10001})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full', 0x20, 0x8000, 0x20, 0x1f}, 0x2f)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x26, 0x4, 0x800)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x23}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20000011)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket(0x26, 0x4, 0x800) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x23}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20000011) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x60}, 0x0)

04:21:37 executing program 5:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x8}, 0x4}}, 0x18)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/168)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x3}, 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c1)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x8}, 0x4}}, 0x18) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/168) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x3}, 0x14}}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c1) (async)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x800040000100000b, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000040)={0x11, 0x21, &(0x7f0000000000)="14bd73977fbcb356864a3feb157301c645a32aded447cd30653390a5611b6db25e"})

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/205)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x61}, 0x0)

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xffffffffdffffffe, 0x80081)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x26, 0x4, 0x800)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x23}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20000011)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket(0x26, 0x4, 0x800) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, 0x0, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x23}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20000011) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)

04:21:37 executing program 4:
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000100)={@hyper, 0x7fffffff})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xfffffffffffffffa, 0x800, 0x9, 0x9, 0x80000000, 0x10001})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full', 0x20, 0x8000, 0x20, 0x1f}, 0x2f)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000100)={@hyper, 0x7fffffff}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xfffffffffffffffa, 0x800, 0x9, 0x9, 0x80000000, 0x10001}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full', 0x20, 0x8000, 0x20, 0x1f}, 0x2f) (async)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x800040000100000b, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000040)={0x11, 0x21, &(0x7f0000000000)="14bd73977fbcb356864a3feb157301c645a32aded447cd30653390a5611b6db25e"})

04:21:37 executing program 5:
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x8}, 0x4}}, 0x18)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/168)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x3}, 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c1)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x8}, 0x4}}, 0x18) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000000040)=""/168) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x3}, 0x14}}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80c1) (async)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x62}, 0x0)

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xffffffffdffffffe, 0x80081)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x404c080, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x8, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/50)

04:21:37 executing program 4:
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000100)={@hyper, 0x7fffffff})
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xfffffffffffffffa, 0x800, 0x9, 0x9, 0x80000000, 0x10001})
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full', 0x20, 0x8000, 0x20, 0x1f}, 0x2f)
ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(0xffffffffffffffff, 0x7af, &(0x7f0000000100)={@hyper, 0x7fffffff}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xfffffffffffffffa, 0x800, 0x9, 0x9, 0x80000000, 0x10001}) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full', 0x20, 0x8000, 0x20, 0x1f}, 0x2f) (async)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x800040000100000b, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000040)={0x11, 0x21, &(0x7f0000000000)="14bd73977fbcb356864a3feb157301c645a32aded447cd30653390a5611b6db25e"})

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x63}, 0x0)

04:21:37 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
clock_getres(0x2, &(0x7f0000000100))
pselect6(0x40, &(0x7f00000008c0)={0xfffffffffffffffe}, &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, &(0x7f00000009c0)={r1, <r2=>0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
socket$inet_mptcp(0x2, 0x1, 0x106)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r2], 0x14}}, 0x20000050)
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000080)={"d1ba78c64bb272f7245db0042f40a61858f00ae378c537a707aa277fdf6f", 0x200007, 0x9, 0x7, [0x0, 0xe93, 0x0, 0x71683a60, 0x0, 0x6, 0x10000, 0x2, 0x81, 0x2, 0x8, 0x8, 0x0, 0x800000, 0xffff, 0x260d, 0x7ff, 0x3]})
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xad, 0x4)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x20004854)

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xffffffffdffffffe, 0x80081)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x404c080, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x8, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/50)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x404c080, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x8, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/50) (async)

04:21:37 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xb713, 0x100)
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000100)=""/238)
r2 = syz_open_dev$evdev(&(0x7f0000000040), 0xac6, 0x40)
clock_gettime(0x0, &(0x7f0000000200)={<r3=>0x0, <r4=>0x0})
write$evdev(r2, &(0x7f0000000300)=[{{r3, r4/1000+10000}, 0x16, 0x81, 0x5}, {{0x77359400}, 0x3, 0x9, 0x80}, {{0x77359400}, 0x15, 0x20, 0x1}, {{0x0, 0xea60}, 0x6, 0x71a, 0xfff}, {{0x77359400}, 0x17, 0x3, 0x1f}], 0x78)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000240)=""/153)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x64}, 0x0)

04:21:37 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0}) (async)
clock_getres(0x2, &(0x7f0000000100))
pselect6(0x40, &(0x7f00000008c0)={0xfffffffffffffffe}, &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, &(0x7f00000009c0)={r1, <r2=>0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r2], 0x14}}, 0x20000050)
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000080)={"d1ba78c64bb272f7245db0042f40a61858f00ae378c537a707aa277fdf6f", 0x200007, 0x9, 0x7, [0x0, 0xe93, 0x0, 0x71683a60, 0x0, 0x6, 0x10000, 0x2, 0x81, 0x2, 0x8, 0x8, 0x0, 0x800000, 0xffff, 0x260d, 0x7ff, 0x3]}) (async)
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xad, 0x4)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x20004854)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x404c080, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x8, @mcast2={0xff, 0x3}}, 0x20)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/50)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x404c080, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x8, @mcast2={0xff, 0x3}}, 0x20) (async)
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/50) (async)

04:21:37 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:37 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xb713, 0x100)
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000100)=""/238) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000040), 0xac6, 0x40)
clock_gettime(0x0, &(0x7f0000000200)={<r3=>0x0, <r4=>0x0})
write$evdev(r2, &(0x7f0000000300)=[{{r3, r4/1000+10000}, 0x16, 0x81, 0x5}, {{0x77359400}, 0x3, 0x9, 0x80}, {{0x77359400}, 0x15, 0x20, 0x1}, {{0x0, 0xea60}, 0x6, 0x71a, 0xfff}, {{0x77359400}, 0x17, 0x3, 0x1f}], 0x78) (async, rerun: 32)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 32)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000240)=""/153)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x65}, 0x0)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b", @ANYRES64=r1], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000009}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40408a5}, 0x80)

04:21:37 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0) (async)

04:21:37 executing program 4:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xb713, 0x100)
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000100)=""/238) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000040), 0xac6, 0x40)
clock_gettime(0x0, &(0x7f0000000200)={<r3=>0x0, <r4=>0x0})
write$evdev(r2, &(0x7f0000000300)=[{{r3, r4/1000+10000}, 0x16, 0x81, 0x5}, {{0x77359400}, 0x3, 0x9, 0x80}, {{0x77359400}, 0x15, 0x20, 0x1}, {{0x0, 0xea60}, 0x6, 0x71a, 0xfff}, {{0x77359400}, 0x17, 0x3, 0x1f}], 0x78)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000240)=""/153)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:37 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
clock_getres(0x2, &(0x7f0000000100)) (async)
pselect6(0x40, &(0x7f00000008c0)={0xfffffffffffffffe}, &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, &(0x7f00000009c0)={r1, <r2=>0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r2], 0x14}}, 0x20000050) (async)
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000080)={"d1ba78c64bb272f7245db0042f40a61858f00ae378c537a707aa277fdf6f", 0x200007, 0x9, 0x7, [0x0, 0xe93, 0x0, 0x71683a60, 0x0, 0x6, 0x10000, 0x2, 0x81, 0x2, 0x8, 0x8, 0x0, 0x800000, 0xffff, 0x260d, 0x7ff, 0x3]}) (async, rerun: 64)
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xad, 0x4) (async, rerun: 64)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x7f}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x20004854)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x66}, 0x0)

04:21:37 executing program 1:
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0)
ioctl$EVIOCSREP(0xffffffffffffffff, 0x541b, 0x0) (async)

04:21:37 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b", @ANYRES64=r1], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000009}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40408a5}, 0x80)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b", @ANYRES64=r1], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000009}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40408a5}, 0x80) (async)

04:21:37 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x41c000)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000001c0)=""/97)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x40)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x3, 0x3])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000000)=[0x401, 0x1, 0x3, 0x3, 0xffefffff, 0x2, 0x3, 0x2])
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/145)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
write$P9_RLERROR(r4, &(0x7f0000000240)={0x14, 0x7, 0x1, {0xb, '/dev/vcsa#\x00'}}, 0x14)

04:21:37 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\b', @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:21:37 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:37 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x67}, 0x0)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\b', @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x41c000)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000001c0)=""/97)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x40)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x3, 0x3])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000000)=[0x401, 0x1, 0x3, 0x3, 0xffefffff, 0x2, 0x3, 0x2])
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/145)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
write$P9_RLERROR(r4, &(0x7f0000000240)={0x14, 0x7, 0x1, {0xb, '/dev/vcsa#\x00'}}, 0x14)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x41c000) (async)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000001c0)=""/97) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x40) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x3, 0x3]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000000)=[0x401, 0x1, 0x3, 0x3, 0xffefffff, 0x2, 0x3, 0x2]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/145) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
write$P9_RLERROR(r4, &(0x7f0000000240)={0x14, 0x7, 0x1, {0xb, '/dev/vcsa#\x00'}}, 0x14) (async)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b", @ANYRES64=r1], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000009}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40408a5}, 0x80)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b", @ANYRES64=r1], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000009}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40408a5}, 0x80) (async)

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x68}, 0x0)

04:21:38 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\b', @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (rerun: 64)

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x69}, 0x0)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x41c000)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000001c0)=""/97)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x40)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x3, 0x3])
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000000)=[0x401, 0x1, 0x3, 0x3, 0xffefffff, 0x2, 0x3, 0x2])
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/145)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
write$P9_RLERROR(r4, &(0x7f0000000240)={0x14, 0x7, 0x1, {0xb, '/dev/vcsa#\x00'}}, 0x14)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x41c000) (async)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000001c0)=""/97) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x40) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x3, 0x3]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000000)=[0x401, 0x1, 0x3, 0x3, 0xffefffff, 0x2, 0x3, 0x2]) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000100)=""/145) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
write$P9_RLERROR(r4, &(0x7f0000000240)={0x14, 0x7, 0x1, {0xb, '/dev/vcsa#\x00'}}, 0x14) (async)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x389, 0x5551011bcc19e6ba)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000040)={0x0, r2}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000100)=""/247)

04:21:38 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000280)=0x20)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x80c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x2}, 0xffffffffffffffcd)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1f7a, 0x68400)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'syztnl0\x00', <r3=>0x0, 0x4, 0x3f, 0x0, 0x6, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x3f}, 0x700, 0x7800, 0x80, 0x81}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000100)={'sit0\x00', r3, 0x2f, 0x4, 0xe8, 0x8, 0x10, @private2, @remote, 0x7, 0x1, 0x8, 0x8}})
ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f00000001c0)={0xffffffffffffffff, 0x7f, "9bf64c", 0x1, 0x40})

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6a}, 0x0)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x70043)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x80000001)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000fc0000000000000800000000"], 0x14}}, 0x0)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000280)=0x20) (async, rerun: 64)
socket$l2tp6(0xa, 0x2, 0x73) (rerun: 64)
sendto$l2tp6(r0, 0x0, 0x0, 0x80c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x2}, 0xffffffffffffffcd)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1f7a, 0x68400)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'syztnl0\x00', <r3=>0x0, 0x4, 0x3f, 0x0, 0x6, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x3f}, 0x700, 0x7800, 0x80, 0x81}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000100)={'sit0\x00', r3, 0x2f, 0x4, 0xe8, 0x8, 0x10, @private2, @remote, 0x7, 0x1, 0x8, 0x8}})
ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f00000001c0)={0xffffffffffffffff, 0x7f, "9bf64c", 0x1, 0x40})

04:21:38 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x10, 0x1, 0x1}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f0000000180), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RMKNOD(r1, &(0x7f0000000140)={0x14, 0x13, 0x2, {0x4, 0x2, 0x2}}, 0x14)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x2, 0x424e22)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f00000001c0)=""/212)
write$P9_RLERROR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="2aa2967f5fcdd42a793c9192e5140000000702000b002f6465762f"], 0x14)
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000100)=""/31)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x389, 0x5551011bcc19e6ba) (async)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000040)={0x0, r2}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000100)=""/247)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x81, 0x18, 0x0, 0x8, "482f8d417741486e5db06099db8cb6d1602ff0595daa59925452461344dcaa16"})
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x89a0, &(0x7f0000000000)="f5")
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6b}, 0x0)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x70043)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x80000001) (async, rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000fc0000000000000800000000"], 0x14}}, 0x0) (rerun: 64)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x389, 0x5551011bcc19e6ba)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000040)={0x0, r2}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000100)=""/247)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x389, 0x5551011bcc19e6ba) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000040)={0x0, r2}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000100)=""/247) (async)

04:21:38 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x10, 0x1, 0x1}}, 0x14) (async)
r0 = syz_open_dev$evdev(&(0x7f0000000180), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
write$P9_RMKNOD(r1, &(0x7f0000000140)={0x14, 0x13, 0x2, {0x4, 0x2, 0x2}}, 0x14)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x2, 0x424e22) (async, rerun: 64)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 64)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f00000001c0)=""/212) (async)
write$P9_RLERROR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="2aa2967f5fcdd42a793c9192e5140000000702000b002f6465762f"], 0x14)
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000100)=""/31)

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6c}, 0x0)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x81, 0x18, 0x0, 0x8, "482f8d417741486e5db06099db8cb6d1602ff0595daa59925452461344dcaa16"}) (async)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x89a0, &(0x7f0000000000)="f5") (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000280)=0x20)
socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x80c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x2}, 0xffffffffffffffcd)
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1f7a, 0x68400)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'syztnl0\x00', <r3=>0x0, 0x4, 0x3f, 0x0, 0x6, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x3f}, 0x700, 0x7800, 0x80, 0x81}})
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000100)={'sit0\x00', r3, 0x2f, 0x4, 0xe8, 0x8, 0x10, @private2, @remote, 0x7, 0x1, 0x8, 0x8}})
ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f00000001c0)={0xffffffffffffffff, 0x7f, "9bf64c", 0x1, 0x40})
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
getpeername$l2tp6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000280)=0x20) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x80c0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x2}, 0xffffffffffffffcd) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x1f7a, 0x68400) (async)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x4, 0x3f, 0x0, 0x6, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x3f}, 0x700, 0x7800, 0x80, 0x81}}) (async)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000100)={'sit0\x00', r3, 0x2f, 0x4, 0xe8, 0x8, 0x10, @private2, @remote, 0x7, 0x1, 0x8, 0x8}}) (async)
ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f00000001c0)={0xffffffffffffffff, 0x7f, "9bf64c", 0x1, 0x40}) (async)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x70043)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0x80000001) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000fc0000000000000800000000"], 0x14}}, 0x0)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x81, 0x2)
ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/126)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x2, 0x400)
ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000000140)=""/174)

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6d}, 0x0)

04:21:38 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x2, {0x10, 0x1, 0x1}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f0000000180), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
write$P9_RMKNOD(r1, &(0x7f0000000140)={0x14, 0x13, 0x2, {0x4, 0x2, 0x2}}, 0x14)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800]) (async, rerun: 32)
r2 = syz_open_dev$vcsa(&(0x7f0000000040), 0x2, 0x424e22) (rerun: 32)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async, rerun: 64)
ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f00000001c0)=""/212) (rerun: 64)
write$P9_RLERROR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="2aa2967f5fcdd42a793c9192e5140000000702000b002f6465762f"], 0x14) (async)
ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000100)=""/31)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x81, 0x18, 0x0, 0x8, "482f8d417741486e5db06099db8cb6d1602ff0595daa59925452461344dcaa16"})
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x89a0, &(0x7f0000000000)="f5")
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x81, 0x18, 0x0, 0x8, "482f8d417741486e5db06099db8cb6d1602ff0595daa59925452461344dcaa16"}) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
ioctl$sock_bt_hci(r1, 0x89a0, &(0x7f0000000000)="f5") (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x0, 0x4}, 0x20)
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4800)
write$P9_RLERROR(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000597d0e9cdbce65cd212ab722e476934055908c2e3751b"], 0xb)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x81, 0x2)
ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/126)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x2, 0x400)
ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000000140)=""/174)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x81, 0x2) (async)
ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/126) (async)
syz_open_dev$vcsa(&(0x7f0000000100), 0x2, 0x400) (async)
ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000000140)=""/174) (async)

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6e}, 0x0)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x50, 0x0, 0x122, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x9}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x5c, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x40}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x5c}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xc}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xcf}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x2c008014}, 0x20000014)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x0, 0x4}, 0x20) (async)
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4800)
write$P9_RLERROR(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000597d0e9cdbce65cd212ab722e476934055908c2e3751b"], 0xb)

04:21:38 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000040)=[0x80000, 0x80000000])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x1)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000080)=""/9)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000100)={0x51, 0x2, 0x3ff, {0x80, 0x8}, {0x800, 0x1f}, @ramp={0x9f41, 0x0, {0x6, 0x7ff, 0xffff, 0x800}}})

04:21:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6f}, 0x0)

04:21:38 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x81, 0x2)
ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000040)=""/126) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000100), 0x2, 0x400)
ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000000140)=""/174)

04:21:38 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x50, 0x0, 0x122, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x9}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001}, 0x0) (async, rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x5c, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x40}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x5c}}, 0x0) (async, rerun: 64)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xc}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xcf}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x2c008014}, 0x20000014)

04:21:38 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x0, 0x4}, 0x20)
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4800)
write$P9_RLERROR(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000597d0e9cdbce65cd212ab722e476934055908c2e3751b"], 0xb)
socket$l2tp6(0xa, 0x2, 0x73) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}, 0x0, 0x4}, 0x20) (async)
pipe2$9p(&(0x7f0000000000), 0x4800) (async)
write$P9_RLERROR(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000597d0e9cdbce65cd212ab722e476934055908c2e3751b"], 0xb) (async)

04:21:39 executing program 4:
ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000000000))
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000040)=[0x80000, 0x80000000])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x1) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000080)=""/9)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000100)={0x51, 0x2, 0x3ff, {0x80, 0x8}, {0x800, 0x1f}, @ramp={0x9f41, 0x0, {0x6, 0x7ff, 0xffff, 0x800}}})

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x70}, 0x0)

04:21:39 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RREADLINK(r1, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x50, 0x0, 0x122, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x9}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x101}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x5c, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x40}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp}, @L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x5c}}, 0x0) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xc}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xcf}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x2c008014}, 0x20000014)

04:21:39 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/56)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8011, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty, 0x0, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x71}, 0x0)

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000844}, 0x0)

04:21:39 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RREADLINK(r1, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:39 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/56)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8011, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty, 0x0, 0x4}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:39 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000040)=[0x80000, 0x80000000])
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x1) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000080)=""/9)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000100)={0x51, 0x2, 0x3ff, {0x80, 0x8}, {0x800, 0x1f}, @ramp={0x9f41, 0x0, {0x6, 0x7ff, 0xffff, 0x800}}})

04:21:39 executing program 4:
ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000000000))
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x72}, 0x0)

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000844}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000844}, 0x0) (async)

04:21:39 executing program 3:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x48d0}, 0x4040)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:39 executing program 4:
ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000000000))
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 0:
ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000000)=""/56) (async)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8011, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty, 0x0, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:39 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RREADLINK(r1, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000844}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000844}, 0x0) (async)

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x73}, 0x0)

04:21:39 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 1:
getgid()
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:39 executing program 0:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x3be)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x81, 0x2, 0x7, 0x8, @rand_addr=' \x01\x00', @empty, 0x20, 0x8, 0x5, 0x2}})
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c058}, 0x8081)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000010)
socket$l2tp6(0xa, 0x2, 0x73)

04:21:39 executing program 3:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x48d0}, 0x4040) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x74}, 0x0)

04:21:39 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 1:
getgid() (async)
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:39 executing program 0:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x3be) (async)
r0 = socket$l2tp6(0xa, 0x2, 0x73) (async)
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x81, 0x2, 0x7, 0x8, @rand_addr=' \x01\x00', @empty, 0x20, 0x8, 0x5, 0x2}}) (async, rerun: 32)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c058}, 0x8081) (async)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000010)
socket$l2tp6(0xa, 0x2, 0x73)

04:21:39 executing program 5:
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0x4, 0x4)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:39 executing program 3:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x48d0}, 0x4040) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x75}, 0x0)

04:21:39 executing program 5:
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0x4, 0x4)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:39 executing program 0:
ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x3be) (async)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
socket$l2tp6(0xa, 0x2, 0x73)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x81, 0x2, 0x7, 0x8, @rand_addr=' \x01\x00', @empty, 0x20, 0x8, 0x5, 0x2}}) (async, rerun: 64)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async, rerun: 64)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c058}, 0x8081)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000010) (async, rerun: 32)
socket$l2tp6(0xa, 0x2, 0x73) (rerun: 32)

04:21:39 executing program 4:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800])
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r1, 0x5452, &(0x7f0000000080)=[0x800]) (async)

04:21:39 executing program 1:
getgid()
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x0)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)
getgid() (async)
syz_open_dev$evdev(&(0x7f0000000000), 0x9, 0x0) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0) (async)

04:21:39 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
clock_gettime(0x0, &(0x7f0000000000)={<r1=>0x0, <r2=>0x0})
write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x12, 0x8, 0xffffffe1}, {{0x0, 0xea60}, 0x3, 0x3ff, 0x9}, {{}, 0x12, 0x0, 0x6}, {{}, 0x0, 0x0, 0x9}, {{}, 0x11, 0x3, 0x80000001}, {{}, 0x17, 0x1ff}, {{r1, r2/1000+60000}, 0x4, 0x10, 0x4}, {{}, 0x0, 0x80, 0x1}], 0xc0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x76}, 0x0)

04:21:39 executing program 5:
setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0x4, 0x4)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:39 executing program 1:
r0 = socket(0x11, 0x4, 0x2b0)
ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x0, 0x6, "f6bdb4", 0x5, 0x37})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0x541b, 0x0)

04:21:39 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x6d}, 0x0)

04:21:39 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7, 0x1b, 0x1}, 0x7)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r2, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x42}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x8000000)
pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80000)
write$P9_RSETATTR(r3, &(0x7f0000000200)={0x7, 0x1b, 0x2}, 0x7)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/142, 0x8e)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000280)={0x14, 0x58, &(0x7f00000001c0)="6bef646bba14289291cbba3a96de98329103b14d06feb6d58b47891824f5e588e2564ba805bd8a8b4970c9d9660292f76807bd7ed9b4c5f056c3eeb29b5c5a35807236480382490d25b47c652f60e4b5a562666d53d1c71a"})
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000000c0)=""/253)

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x77}, 0x0)

04:21:39 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
clock_gettime(0x0, &(0x7f0000000000)={<r1=>0x0, <r2=>0x0})
write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x12, 0x8, 0xffffffe1}, {{0x0, 0xea60}, 0x3, 0x3ff, 0x9}, {{}, 0x12, 0x0, 0x6}, {{}, 0x0, 0x0, 0x9}, {{}, 0x11, 0x3, 0x80000001}, {{}, 0x17, 0x1ff}, {{r1, r2/1000+60000}, 0x4, 0x10, 0x4}, {{}, 0x0, 0x80, 0x1}], 0xc0) (async, rerun: 64)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (rerun: 64)

04:21:39 executing program 1:
r0 = socket(0x11, 0x4, 0x2b0)
ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x0, 0x6, "f6bdb4", 0x5, 0x37}) (async)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r1, 0x541b, 0x0)

04:21:39 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x69}, 0x0)

04:21:39 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7, 0x1b, 0x1}, 0x7)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r2, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x42}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x8000000)
pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80000)
write$P9_RSETATTR(r3, &(0x7f0000000200)={0x7, 0x1b, 0x2}, 0x7)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7, 0x1b, 0x1}, 0x7) (async)
socket$l2tp6(0xa, 0x2, 0x73) (async)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20) (async)
sendto$l2tp6(r2, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x42}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x8000000) (async)
pipe2$9p(&(0x7f00000001c0), 0x80000) (async)
write$P9_RSETATTR(r3, &(0x7f0000000200)={0x7, 0x1b, 0x2}, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'}) (async)

04:21:39 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/142, 0x8e)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000280)={0x14, 0x58, &(0x7f00000001c0)="6bef646bba14289291cbba3a96de98329103b14d06feb6d58b47891824f5e588e2564ba805bd8a8b4970c9d9660292f76807bd7ed9b4c5f056c3eeb29b5c5a35807236480382490d25b47c652f60e4b5a562666d53d1c71a"})
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000000c0)=""/253)
socket$nl_generic(0x10, 0x3, 0x10) (async)
read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/142, 0x8e) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000280)={0x14, 0x58, &(0x7f00000001c0)="6bef646bba14289291cbba3a96de98329103b14d06feb6d58b47891824f5e588e2564ba805bd8a8b4970c9d9660292f76807bd7ed9b4c5f056c3eeb29b5c5a35807236480382490d25b47c652f60e4b5a562666d53d1c71a"}) (async)
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000000c0)=""/253) (async)

04:21:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x78}, 0x0)

04:21:39 executing program 4:
write$P9_RSYMLINK(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x11, 0x1, {0x10, 0x2, 0x2}}, 0x14)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])

04:21:39 executing program 1:
r0 = socket(0x11, 0x4, 0x2b0)
ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x0, 0x6, "f6bdb4", 0x5, 0x37}) (async, rerun: 64)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (rerun: 64)
ioctl$EVIOCSREP(r1, 0x541b, 0x0)

04:21:40 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
clock_gettime(0x0, &(0x7f0000000000)={<r1=>0x0, <r2=>0x0})
write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x12, 0x8, 0xffffffe1}, {{0x0, 0xea60}, 0x3, 0x3ff, 0x9}, {{}, 0x12, 0x0, 0x6}, {{}, 0x0, 0x0, 0x9}, {{}, 0x11, 0x3, 0x80000001}, {{}, 0x17, 0x1ff}, {{r1, r2/1000+60000}, 0x4, 0x10, 0x4}, {{}, 0x0, 0x80, 0x1}], 0xc0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:40 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/142, 0x8e) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000280)={0x14, 0x58, &(0x7f00000001c0)="6bef646bba14289291cbba3a96de98329103b14d06feb6d58b47891824f5e588e2564ba805bd8a8b4970c9d9660292f76807bd7ed9b4c5f056c3eeb29b5c5a35807236480382490d25b47c652f60e4b5a562666d53d1c71a"}) (async)
ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000000c0)=""/253)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7, 0x1b, 0x1}, 0x7)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async)
sendto$l2tp6(r2, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r2, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x42}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x8000000)
pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80000)
write$P9_RSETATTR(r3, &(0x7f0000000200)={0x7, 0x1b, 0x2}, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x79}, 0x0)

04:21:40 executing program 4:
syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x1)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000180)={0x1ff, 0x8, 0x9, 0x100, 0x1, 0x40000400})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
pipe2$watch_queue(&(0x7f0000000140), 0x80)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0003257d15e32cc35be530f05f52b35ddbdf2504bc1d92d813a170ee89b60005001200fb00000006001c01f104000f0500040008000000f2929fcc143bd570db2b5ce589b9073af1ca095bf0c89933b19b9cd111e757b4"], 0x34}, 0x1, 0x0, 0x0, 0x2884}, 0x50)
getrusage(0xffffffffffffffff, &(0x7f0000000300))
bind$l2tp6(r3, &(0x7f0000000100)={0xa, 0x0, 0x6, @private2, 0x6, 0x2}, 0x20)
ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f0000000080)={{@my=0x1, 0x6}, 0x0, 0x1, 0x2})
r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r6, 0x541b, 0x0)
ioctl$EVIOCGRAB(r6, 0x40044590, &(0x7f0000000000)=0x6)

04:21:40 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000100))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000140)=""/203)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/120)

04:21:40 executing program 1:
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000140)=0x9)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180)=0x3f)
r1 = socket(0x1f, 0x800, 0x4)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000000)={@any, 0x18000000, 0x4, 0x4})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)
getpeername$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x20)

04:21:40 executing program 0:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000080)=[0x800])
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r1, 0x7a6, &(0x7f0000000040)={0xf4, 0x1, 0x81, 0x8, 0x80000000, 0x1})
r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x181000)
ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/90)
write$P9_RWALK(r1, &(0x7f0000000180)={0x57, 0x6f, 0x2, {0x6, [{0x10, 0x1, 0x7}, {0x40, 0x0, 0x6}, {0x20, 0x0, 0x1}, {0x4, 0x0, 0x5}, {0x0, 0x4, 0x6}, {0x4, 0x3, 0x1}]}}, 0x57)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:40 executing program 5:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x400400, 0x0)
r0 = socket(0x22, 0x3, 0x0)
recvfrom$l2tp6(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:40 executing program 1:
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000140)=0x9)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180)=0x3f)
r1 = socket(0x1f, 0x800, 0x4)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000000)={@any, 0x18000000, 0x4, 0x4})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)
getpeername$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x20)
pipe2$watch_queue(&(0x7f0000000100), 0x80) (async)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000140)=0x9) (async)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180)=0x3f) (async)
socket(0x1f, 0x800, 0x4) (async)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000000)={@any, 0x18000000, 0x4, 0x4}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r2, 0x541b, 0x0) (async)
getpeername$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x20) (async)

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7a}, 0x0)

04:21:40 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000100))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000140)=""/203) (async)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/120)

04:21:40 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:40 executing program 5:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x400400, 0x0)
r0 = socket(0x22, 0x3, 0x0)
recvfrom$l2tp6(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x400400, 0x0) (async)
socket(0x22, 0x3, 0x0) (async)
recvfrom$l2tp6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7b}, 0x0)

04:21:40 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000100))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000140)=""/203)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/120)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000100)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000140)=""/203) (async)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/120) (async)

04:21:40 executing program 1:
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000140)=0x9) (async)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180)=0x3f) (async)
r1 = socket(0x1f, 0x800, 0x4)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000000)={@any, 0x18000000, 0x4, 0x4}) (async)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0x541b, 0x0) (async)
getpeername$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x20)

04:21:40 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7c}, 0x0)

04:21:40 executing program 5:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x400400, 0x0) (async)
r0 = socket(0x22, 0x3, 0x0)
recvfrom$l2tp6(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:40 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x81}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x20000000)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
pipe2$9p(&(0x7f00000001c0), 0x40800)
pipe2$watch_queue(&(0x7f0000000140), 0x80)
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x8, 0x8640)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7d}, 0x0)

04:21:40 executing program 3:
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80)
r1 = geteuid()
write$P9_RSTATu(r0, &(0x7f0000000100)={0x6e, 0x7d, 0x1, {{0x0, 0x47, 0x7, 0x1, {0x0, 0x2, 0x2}, 0x30810000, 0x100, 0x9, 0x5, 0x6, '*-!*[(', 0x5, ':}#\x06%', 0x9, '){^@^--:,'}, 0x12, '/dev/input/event#\x00', 0x0, 0xee00, r1}}, 0x6e)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000080))

04:21:40 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000e65d320ed5d700738e49e36d9e75f7aa20b83160c966c19795f52ba19587581552b05222d372b12476ab465e903e225193afca97870e8fccb7550cfb4f75a1d3a7e38d95fc1366c7b3dd6b6fb8", @ANYRES16=0x0, @ANYBLOB="0002000000000000000204000000050006000500000006001b004e21000006000300090000000500040002000000060002000100000006001c0009000000050012000700000006000e0000000000"], 0x54}}, 0x4000084)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r1, 0x302, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1000}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x100000001)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303, r4}, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:40 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x81}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x20000000)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
pipe2$9p(&(0x7f00000001c0), 0x40800)
pipe2$watch_queue(&(0x7f0000000140), 0x80)
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x8, 0x8640)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x81}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
pipe2$9p(&(0x7f00000001c0), 0x40800) (async)
pipe2$watch_queue(&(0x7f0000000140), 0x80) (async)
syz_open_dev$evdev(&(0x7f0000000180), 0x8, 0x8640) (async)
ioctl$EVIOCSREP(r2, 0x541b, 0x0) (async)

04:21:40 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:40 executing program 3:
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80) (async)
r1 = geteuid()
write$P9_RSTATu(r0, &(0x7f0000000100)={0x6e, 0x7d, 0x1, {{0x0, 0x47, 0x7, 0x1, {0x0, 0x2, 0x2}, 0x30810000, 0x100, 0x9, 0x5, 0x6, '*-!*[(', 0x5, ':}#\x06%', 0x9, '){^@^--:,'}, 0x12, '/dev/input/event#\x00', 0x0, 0xee00, r1}}, 0x6e)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000080))

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x7e}, 0x0)

04:21:40 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000e65d320ed5d700738e49e36d9e75f7aa20b83160c966c19795f52ba19587581552b05222d372b12476ab465e903e225193afca97870e8fccb7550cfb4f75a1d3a7e38d95fc1366c7b3dd6b6fb8", @ANYRES16=0x0, @ANYBLOB="0002000000000000000204000000050006000500000006001b004e21000006000300090000000500040002000000060002000100000006001c0009000000050012000700000006000e0000000000"], 0x54}}, 0x4000084)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r1, 0x302, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1000}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000e65d320ed5d700738e49e36d9e75f7aa20b83160c966c19795f52ba19587581552b05222d372b12476ab465e903e225193afca97870e8fccb7550cfb4f75a1d3a7e38d95fc1366c7b3dd6b6fb8", @ANYRES16=0x0, @ANYBLOB="0002000000000000000204000000050006000500000006001b004e21000006000300090000000500040002000000060002000100000006001c0009000000050012000700000006000e0000000000"], 0x54}}, 0x4000084) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r1, 0x302, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1000}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000) (async)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x82}, 0x0)

04:21:40 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x81}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
pipe2$9p(&(0x7f00000001c0), 0x40800) (async)
pipe2$watch_queue(&(0x7f0000000140), 0x80) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x8, 0x8640)
ioctl$EVIOCSREP(r2, 0x541b, 0x0)

04:21:40 executing program 3:
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80)
r1 = geteuid()
write$P9_RSTATu(r0, &(0x7f0000000100)={0x6e, 0x7d, 0x1, {{0x0, 0x47, 0x7, 0x1, {0x0, 0x2, 0x2}, 0x30810000, 0x100, 0x9, 0x5, 0x6, '*-!*[(', 0x5, ':}#\x06%', 0x9, '){^@^--:,'}, 0x12, '/dev/input/event#\x00', 0x0, 0xee00, r1}}, 0x6e)
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000080))
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
geteuid() (async)
write$P9_RSTATu(r0, &(0x7f0000000100)={0x6e, 0x7d, 0x1, {{0x0, 0x47, 0x7, 0x1, {0x0, 0x2, 0x2}, 0x30810000, 0x100, 0x9, 0x5, 0x6, '*-!*[(', 0x5, ':}#\x06%', 0x9, '){^@^--:,'}, 0x12, '/dev/input/event#\x00', 0x0, 0xee00, r1}}, 0x6e) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r2, 0xc0189436, &(0x7f0000000080)) (async)

04:21:40 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000e65d320ed5d700738e49e36d9e75f7aa20b83160c966c19795f52ba19587581552b05222d372b12476ab465e903e225193afca97870e8fccb7550cfb4f75a1d3a7e38d95fc1366c7b3dd6b6fb8", @ANYRES16=0x0, @ANYBLOB="0002000000000000000204000000050006000500000006001b004e21000006000300090000000500040002000000060002000100000006001c0009000000050012000700000006000e0000000000"], 0x54}}, 0x4000084)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r1, 0x302, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1000}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000)

04:21:40 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})
recvfrom$l2tp6(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x40000101, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x20)

04:21:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x83}, 0x0)

04:21:40 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x800)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:40 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:40 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xb67, 0xc00)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0xd, 0xaf, &(0x7f0000000100)="b9c6730f75a6ab6de6cc1abc7a95a0529d0ba4d791aecc05906803c07b06fe0c91067b884c5d9935335a149a3071aa718f344ca06046bf2a885fab96a5b6a07a0bd532fcb39cbb33aeb0730cfab00312b9f194bcc1df1b3bd8decdf171d8f4d18d20665d02c64df6c3673a4ea249f54a2c91fdeda77a1de89e02747cc66a98a089e328529e8a3f293d66e8ddcf20cfcea6aa31742a9a6f8dad537a99259e7e54a4211f946618c5fe67d87c18805253"})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x84}, 0x0)

04:21:41 executing program 5:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000000)=""/112)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0099c9f5be4349dd35fff9002e45"], 0x14}}, 0x0)

04:21:41 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x800)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:41 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xb67, 0xc00)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0xd, 0xaf, &(0x7f0000000100)="b9c6730f75a6ab6de6cc1abc7a95a0529d0ba4d791aecc05906803c07b06fe0c91067b884c5d9935335a149a3071aa718f344ca06046bf2a885fab96a5b6a07a0bd532fcb39cbb33aeb0730cfab00312b9f194bcc1df1b3bd8decdf171d8f4d18d20665d02c64df6c3673a4ea249f54a2c91fdeda77a1de89e02747cc66a98a089e328529e8a3f293d66e8ddcf20cfcea6aa31742a9a6f8dad537a99259e7e54a4211f946618c5fe67d87c18805253"}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
socket(0x10, 0x3, 0x1)
ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, &(0x7f0000000040)={0x3ff, 0x1, 0x3ff, 0x4, 0x8, 0x7fe9})

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x85}, 0x0)

04:21:41 executing program 5:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000000)=""/112) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0099c9f5be4349dd35fff9002e45"], 0x14}}, 0x0)

04:21:41 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xb67, 0xc00)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0xd, 0xaf, &(0x7f0000000100)="b9c6730f75a6ab6de6cc1abc7a95a0529d0ba4d791aecc05906803c07b06fe0c91067b884c5d9935335a149a3071aa718f344ca06046bf2a885fab96a5b6a07a0bd532fcb39cbb33aeb0730cfab00312b9f194bcc1df1b3bd8decdf171d8f4d18d20665d02c64df6c3673a4ea249f54a2c91fdeda77a1de89e02747cc66a98a089e328529e8a3f293d66e8ddcf20cfcea6aa31742a9a6f8dad537a99259e7e54a4211f946618c5fe67d87c18805253"})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xb67, 0xc00) (async)
ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000000)={0xd, 0xaf, &(0x7f0000000100)="b9c6730f75a6ab6de6cc1abc7a95a0529d0ba4d791aecc05906803c07b06fe0c91067b884c5d9935335a149a3071aa718f344ca06046bf2a885fab96a5b6a07a0bd532fcb39cbb33aeb0730cfab00312b9f194bcc1df1b3bd8decdf171d8f4d18d20665d02c64df6c3673a4ea249f54a2c91fdeda77a1de89e02747cc66a98a089e328529e8a3f293d66e8ddcf20cfcea6aa31742a9a6f8dad537a99259e7e54a4211f946618c5fe67d87c18805253"}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:41 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0xfffffffffffffffe, 0x800)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 5:
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000000)=""/112)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0099c9f5be4349dd35fff9002e45"], 0x14}}, 0x0)

04:21:41 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xde, 0x208001)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x86}, 0x0)

04:21:41 executing program 4:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
socket(0x10, 0x3, 0x1)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0x6)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x9])
socket$bt_cmtp(0x1f, 0x3, 0x5)

04:21:41 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xde, 0x208001)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0x6) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x87}, 0x0)

04:21:41 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x9])
socket$bt_cmtp(0x1f, 0x3, 0x5)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x9]) (async)
socket$bt_cmtp(0x1f, 0x3, 0x5) (async)

04:21:41 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xde, 0x208001)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
ioctl$EVIOCSREP(r0, 0x541b, 0x0)

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x88}, 0x0)

04:21:41 executing program 4:
socket$l2tp6(0xa, 0x2, 0x73)
socket(0x10, 0x3, 0x1)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0x6)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000040)=0x6) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async, rerun: 64)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x9, 0x9]) (async, rerun: 64)
socket$bt_cmtp(0x1f, 0x3, 0x5)

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x89}, 0x0)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:41 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 4:
socket(0x10, 0x3, 0x1)

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8a}, 0x0)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:41 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8b}, 0x0)

04:21:41 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', <r0=>0x0, 0x4, 0x8, 0x1, 0xea, 0x20, @remote, @private2, 0x8000, 0x7800, 0x8000, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000140)={'ip6gre0\x00', r0, 0x4, 0xcd, 0x8, 0x10001, 0x1, @mcast1, @local, 0x8, 0x10, 0x9, 0xf55f}})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
recvfrom$l2tp6(0xffffffffffffffff, &(0x7f0000000380)=""/117, 0x75, 0x40000041, &(0x7f0000000400)={0xa, 0x0, 0x0, @remote}, 0x20)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000200)={'syztnl1\x00', <r3=>r0, 0x4, 0xf0, 0x40, 0x9, 0x14, @mcast1, @empty, 0x7800, 0x700, 0xc71a, 0x8}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'sit0\x00', r3, 0x29, 0x5, 0x40, 0x3, 0x5, @local, @loopback, 0x10, 0x700, 0x9b, 0xfffff000}})

04:21:41 executing program 4:
socket(0x0, 0x3, 0x1)

04:21:41 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:41 executing program 0:
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:41 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', <r0=>0x0, 0x4, 0x8, 0x1, 0xea, 0x20, @remote, @private2, 0x8000, 0x7800, 0x8000, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000140)={'ip6gre0\x00', r0, 0x4, 0xcd, 0x8, 0x10001, 0x1, @mcast1, @local, 0x8, 0x10, 0x9, 0xf55f}})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
recvfrom$l2tp6(0xffffffffffffffff, &(0x7f0000000380)=""/117, 0x75, 0x40000041, &(0x7f0000000400)={0xa, 0x0, 0x0, @remote}, 0x20) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000200)={'syztnl1\x00', <r3=>r0, 0x4, 0xf0, 0x40, 0x9, 0x14, @mcast1, @empty, 0x7800, 0x700, 0xc71a, 0x8}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'sit0\x00', r3, 0x29, 0x5, 0x40, 0x3, 0x5, @local, @loopback, 0x10, 0x700, 0x9b, 0xfffff000}})

04:21:41 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8c}, 0x0)

04:21:42 executing program 5:
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x11)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8d}, 0x0)

04:21:42 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', <r0=>0x0, 0x4, 0x8, 0x1, 0xea, 0x20, @remote, @private2, 0x8000, 0x7800, 0x8000, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000140)={'ip6gre0\x00', r0, 0x4, 0xcd, 0x8, 0x10001, 0x1, @mcast1, @local, 0x8, 0x10, 0x9, 0xf55f}})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
recvfrom$l2tp6(0xffffffffffffffff, &(0x7f0000000380)=""/117, 0x75, 0x40000041, &(0x7f0000000400)={0xa, 0x0, 0x0, @remote}, 0x20)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000200)={'syztnl1\x00', <r3=>r0, 0x4, 0xf0, 0x40, 0x9, 0x14, @mcast1, @empty, 0x7800, 0x700, 0xc71a, 0x8}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'sit0\x00', r3, 0x29, 0x5, 0x40, 0x3, 0x5, @local, @loopback, 0x10, 0x700, 0x9b, 0xfffff000}})
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x8, 0x1, 0xea, 0x20, @remote, @private2, 0x8000, 0x7800, 0x8000, 0x9}}) (async)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000140)={'ip6gre0\x00', r0, 0x4, 0xcd, 0x8, 0x10001, 0x1, @mcast1, @local, 0x8, 0x10, 0x9, 0xf55f}}) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
recvfrom$l2tp6(0xffffffffffffffff, &(0x7f0000000380)=""/117, 0x75, 0x40000041, &(0x7f0000000400)={0xa, 0x0, 0x0, @remote}, 0x20) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000200)={'syztnl1\x00', r0, 0x4, 0xf0, 0x40, 0x9, 0x14, @mcast1, @empty, 0x7800, 0x700, 0xc71a, 0x8}}) (async)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000002c0)={'sit0\x00', r3, 0x29, 0x5, 0x40, 0x3, 0x5, @local, @loopback, 0x10, 0x700, 0x9b, 0xfffff000}}) (async)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 4:
socket(0x0, 0x3, 0x1)

04:21:42 executing program 3:
getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:42 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 5:
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x11) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8e}, 0x0)

04:21:42 executing program 5:
sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x11) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 3:
getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 4:
socket(0x0, 0x3, 0x1)

04:21:42 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x8f}, 0x0)

04:21:42 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 3:
getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:42 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x90}, 0x0)

04:21:42 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 4:
socket(0x10, 0x0, 0x1)

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x91}, 0x0)

04:21:42 executing program 4:
socket(0x10, 0x0, 0x1)

04:21:42 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/187)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:42 executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:42 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 4:
socket(0x10, 0x0, 0x1)

04:21:42 executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/187) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x92}, 0x0)

04:21:42 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)

04:21:42 executing program 1:
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x93}, 0x0)

04:21:42 executing program 4:
socket(0x10, 0x3, 0x0)

04:21:42 executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/187)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000100)=""/187) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:42 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)

04:21:42 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:42 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:42 executing program 4:
socket(0x10, 0x3, 0x0)

04:21:42 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x200100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2])

04:21:42 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)

04:21:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x94}, 0x0)

04:21:43 executing program 4:
socket(0x10, 0x3, 0x0)

04:21:43 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x95}, 0x0)

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8005)

[ 3547.418914][T30968] binder: 30966:30968 ioctl c0306201 0 returned -14
04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x200100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2])

04:21:43 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x96}, 0x0)

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 3547.511823][T30979] binder: 30975:30979 ioctl c0306201 0 returned -14
04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8005)

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x97}, 0x0)

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x200100)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x2])

04:21:43 executing program 4:
getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:43 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3547.627510][T30992] binder: 30988:30992 ioctl c0306201 0 returned -14
04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x200000)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0x80000001, 0x6, 0xa2, 0x10001, 0x3, 0x81})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0xfff])

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x98}, 0x0)

04:21:43 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8005)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8005) (async)

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x200000)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0x80000001, 0x6, 0xa2, 0x10001, 0x3, 0x81})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0xfff])

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x99}, 0x0)

04:21:43 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\a\x00\x00!', @ANYRES16=r0, @ANYBLOB="00000000000002000000040000009fa14140c90014139bd66f2d8753ddcfbe3e0cb867f0a461b0df0dae4b15b71b5d3da2ba2b87a51d4a7c15f36947ae79ce85c27b9a55"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008001)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32030414}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004801}, 0x8080)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000129bd7000fbdbdf250400000005000d000100000005001300070000f2396042ac363979f3d9adc494ae1ac94db17241f31b593e7428c1603fc809d733d9e0aec2ffa84432386344091b4e3f6c0af407163479011fa3ae"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x8014)
r4 = syz_open_dev$vcsa(&(0x7f0000000180), 0x101, 0x2c0000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000640)={0x60, r5, 0x521, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff7f}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffb}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4f2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000010)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ffdbff25040000080500120000000000b8d322e4f24246bef47c162cf8504a5d3ba77acd2f3367035157a32e6c718dffcae7a6e09f680e9c0f22fde09f54a58d67d7b293c75debfa8cf2de5dcbaae7692590ce0ff7abac0d48fddfd34eeaa50e9aec1fc3a44279a12dcb1f8d61e02b42d2dbff022a8cac60e5aef78294fdb39c631b6accd13539658c2fc542e933a936bd735edcbd764511d69523c54e5407a1cfa0defcff0ac72a9bf278360e188865497ccfd5"], 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x4000000)

04:21:43 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x200000)
ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0x80000001, 0x6, 0xa2, 0x10001, 0x3, 0x81})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0xfff])

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9a}, 0x0)

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\a\x00\x00!', @ANYRES16=r0, @ANYBLOB="00000000000002000000040000009fa14140c90014139bd66f2d8753ddcfbe3e0cb867f0a461b0df0dae4b15b71b5d3da2ba2b87a51d4a7c15f36947ae79ce85c27b9a55"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008001)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32030414}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004801}, 0x8080) (async)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000129bd7000fbdbdf250400000005000d000100000005001300070000f2396042ac363979f3d9adc494ae1ac94db17241f31b593e7428c1603fc809d733d9e0aec2ffa84432386344091b4e3f6c0af407163479011fa3ae"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x8014) (async)
r4 = syz_open_dev$vcsa(&(0x7f0000000180), 0x101, 0x2c0000) (async)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000640)={0x60, r5, 0x521, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff7f}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffb}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4f2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000010) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ffdbff25040000080500120000000000b8d322e4f24246bef47c162cf8504a5d3ba77acd2f3367035157a32e6c718dffcae7a6e09f680e9c0f22fde09f54a58d67d7b293c75debfa8cf2de5dcbaae7692590ce0ff7abac0d48fddfd34eeaa50e9aec1fc3a44279a12dcb1f8d61e02b42d2dbff022a8cac60e5aef78294fdb39c631b6accd13539658c2fc542e933a936bd735edcbd764511d69523c54e5407a1cfa0defcff0ac72a9bf278360e188865497ccfd5"], 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x4000000)

04:21:43 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9b}, 0x0)

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x40, 0x3ff, 0x1ff, 0x9, 0x2cc, 0x678d})
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x828c0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000040)={0x20, 0x1ff, 0xfff, 0x1, 0x401})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/112)

04:21:43 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\a\x00\x00!', @ANYRES16=r0, @ANYBLOB="00000000000002000000040000009fa14140c90014139bd66f2d8753ddcfbe3e0cb867f0a461b0df0dae4b15b71b5d3da2ba2b87a51d4a7c15f36947ae79ce85c27b9a55"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008001)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32030414}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004801}, 0x8080)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000129bd7000fbdbdf250400000005000d000100000005001300070000f2396042ac363979f3d9adc494ae1ac94db17241f31b593e7428c1603fc809d733d9e0aec2ffa84432386344091b4e3f6c0af407163479011fa3ae"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x8014)
r4 = syz_open_dev$vcsa(&(0x7f0000000180), 0x101, 0x2c0000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000640)={0x60, r5, 0x521, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff7f}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffb}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4f2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000010)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ffdbff25040000080500120000000000b8d322e4f24246bef47c162cf8504a5d3ba77acd2f3367035157a32e6c718dffcae7a6e09f680e9c0f22fde09f54a58d67d7b293c75debfa8cf2de5dcbaae7692590ce0ff7abac0d48fddfd34eeaa50e9aec1fc3a44279a12dcb1f8d61e02b42d2dbff022a8cac60e5aef78294fdb39c631b6accd13539658c2fc542e933a936bd735edcbd764511d69523c54e5407a1cfa0defcff0ac72a9bf278360e188865497ccfd5"], 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x4000000)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\a\x00\x00!', @ANYRES16=r0, @ANYBLOB="00000000000002000000040000009fa14140c90014139bd66f2d8753ddcfbe3e0cb867f0a461b0df0dae4b15b71b5d3da2ba2b87a51d4a7c15f36947ae79ce85c27b9a55"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008001) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32030414}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004801}, 0x8080) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000129bd7000fbdbdf250400000005000d000100000005001300070000f2396042ac363979f3d9adc494ae1ac94db17241f31b593e7428c1603fc809d733d9e0aec2ffa84432386344091b4e3f6c0af407163479011fa3ae"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x8014) (async)
syz_open_dev$vcsa(&(0x7f0000000180), 0x101, 0x2c0000) (async)
syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) (async)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000640)={0x60, r5, 0x521, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff7f}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffb}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4f2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000010) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ffdbff25040000080500120000000000b8d322e4f24246bef47c162cf8504a5d3ba77acd2f3367035157a32e6c718dffcae7a6e09f680e9c0f22fde09f54a58d67d7b293c75debfa8cf2de5dcbaae7692590ce0ff7abac0d48fddfd34eeaa50e9aec1fc3a44279a12dcb1f8d61e02b42d2dbff022a8cac60e5aef78294fdb39c631b6accd13539658c2fc542e933a936bd735edcbd764511d69523c54e5407a1cfa0defcff0ac72a9bf278360e188865497ccfd5"], 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x4000000) (async)

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x40, 0x3ff, 0x1ff, 0x9, 0x2cc, 0x678d}) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x828c0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000040)={0x20, 0x1ff, 0xfff, 0x1, 0x401}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/112)

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9c}, 0x0)

04:21:43 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:43 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3548.206062][T31054] binder: 31050:31054 ioctl c0306201 0 returned -14
04:21:43 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:43 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x40, 0x3ff, 0x1ff, 0x9, 0x2cc, 0x678d}) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x828c0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000040)={0x20, 0x1ff, 0xfff, 0x1, 0x401}) (async, rerun: 32)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async, rerun: 32)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/112)

04:21:43 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000800000000000004000000b98d36"], 0x14}}, 0x0)

04:21:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9d}, 0x0)

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3548.340007][T31074] binder: 31073:31074 ioctl c0306201 0 returned -14
04:21:44 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000800000000000004000000b98d36"], 0x14}}, 0x0)

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9e}, 0x0)

04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x2, 0x4])
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000000)=""/92)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000800000000000004000000b98d36"], 0x14}}, 0x0)

[ 3548.489662][T31090] binder: 31087:31090 ioctl c0306201 0 returned -14
04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x2, 0x4])
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000000)=""/92)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x2, 0x4]) (async)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000000)=""/92) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x9f}, 0x0)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa0}, 0x0)

04:21:44 executing program 5:
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000000)={"0a804d5b9b9fb904ac06e80685b6a387e24d7efafebafcbb083546ddccc5", 0xe32, 0x200, 0x3, [0xff, 0xfffffff8, 0x0, 0xfffffff8, 0x9, 0x60, 0x81, 0x3, 0xfffffffb, 0x1ff, 0x7d, 0x0, 0xff, 0x6, 0x0, 0x8, 0x9d2, 0x7]})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="57646106ed4bffe22362e3e6a4f1f01946e073cbe8c3c39ddc63249987b970067ea164214e6def38f2222361ae4250798b2708162470d085a1d814f28dbe94372f4d3187907eb54616b3befda6ca5c62bd96f8dd66e329", @ANYRES16=0x0, @ANYBLOB="080028bd7000fedbdf2507000000080011000000000005000d0000000000050005000100000008000c000100000005001400bf0000000600030000000000050022000000000006001c0003000000"], 0x54}, 0x1, 0x0, 0x0, 0x4040004}, 0x8804)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r2, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44810}, 0x40000)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="007ed46c6b23a2bdb3001c3900006813e76b0034cdb11d254a0b16f438ebb443f8876c12786f823c2ad30361131df122712813bab6e58efd00000000b27d17da54a398a7489b694bdbf06b64377ff72b22d3cb64ce0f90dd3e37a57721f6fffbf5c4d3d236c5c8f306742453f1672cfb6081de1da47d8040660aac17ea4af5aeee47684a845787db7b30b5660214a5dee5869c61fbaab4bfa1026d99fec77a0a8aa74882f9122e353d89dfbf43a58d0543710b25f652db62aac6f91914ccda1ab5dac915cfc12720929af764d79368cac238bb39141146915059b3e914ef02863cd8edddf458d2db507b2c55abe8e058c3d3639cd8b255e4b3f72ff432014b45ede9630952073290fa9f970957e961a2e775f9a45c9dffc79cc80f957e7a550466c368d79b9797b1c6df23a13518cceaec8583b7172c2347e13153c3cd9720cca8a8096edfa81ec50f8bcaed74a732de0f9bbfe15d8c5a3ed79c5ee6077f9628e42636b3fd89d663afa84e6f5cbf60effb3dcae50247f37450734343ed943a87dd0e03990700a64b4aff"], 0x14}}, 0x0)

04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x2, 0x4])
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000000)=""/92)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000100)=[0x2, 0x4]) (async)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000000)=""/92) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa1}, 0x0)

04:21:44 executing program 5:
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000000)={"0a804d5b9b9fb904ac06e80685b6a387e24d7efafebafcbb083546ddccc5", 0xe32, 0x200, 0x3, [0xff, 0xfffffff8, 0x0, 0xfffffff8, 0x9, 0x60, 0x81, 0x3, 0xfffffffb, 0x1ff, 0x7d, 0x0, 0xff, 0x6, 0x0, 0x8, 0x9d2, 0x7]})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="57646106ed4bffe22362e3e6a4f1f01946e073cbe8c3c39ddc63249987b970067ea164214e6def38f2222361ae4250798b2708162470d085a1d814f28dbe94372f4d3187907eb54616b3befda6ca5c62bd96f8dd66e329", @ANYRES16=0x0, @ANYBLOB="080028bd7000fedbdf2507000000080011000000000005000d0000000000050005000100000008000c000100000005001400bf0000000600030000000000050022000000000006001c0003000000"], 0x54}, 0x1, 0x0, 0x0, 0x4040004}, 0x8804)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r2, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44810}, 0x40000)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="007ed46c6b23a2bdb3001c3900006813e76b0034cdb11d254a0b16f438ebb443f8876c12786f823c2ad30361131df122712813bab6e58efd00000000b27d17da54a398a7489b694bdbf06b64377ff72b22d3cb64ce0f90dd3e37a57721f6fffbf5c4d3d236c5c8f306742453f1672cfb6081de1da47d8040660aac17ea4af5aeee47684a845787db7b30b5660214a5dee5869c61fbaab4bfa1026d99fec77a0a8aa74882f9122e353d89dfbf43a58d0543710b25f652db62aac6f91914ccda1ab5dac915cfc12720929af764d79368cac238bb39141146915059b3e914ef02863cd8edddf458d2db507b2c55abe8e058c3d3639cd8b255e4b3f72ff432014b45ede9630952073290fa9f970957e961a2e775f9a45c9dffc79cc80f957e7a550466c368d79b9797b1c6df23a13518cceaec8583b7172c2347e13153c3cd9720cca8a8096edfa81ec50f8bcaed74a732de0f9bbfe15d8c5a3ed79c5ee6077f9628e42636b3fd89d663afa84e6f5cbf60effb3dcae50247f37450734343ed943a87dd0e03990700a64b4aff"], 0x14}}, 0x0)
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000000)={"0a804d5b9b9fb904ac06e80685b6a387e24d7efafebafcbb083546ddccc5", 0xe32, 0x200, 0x3, [0xff, 0xfffffff8, 0x0, 0xfffffff8, 0x9, 0x60, 0x81, 0x3, 0xfffffffb, 0x1ff, 0x7d, 0x0, 0xff, 0x6, 0x0, 0x8, 0x9d2, 0x7]}) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="57646106ed4bffe22362e3e6a4f1f01946e073cbe8c3c39ddc63249987b970067ea164214e6def38f2222361ae4250798b2708162470d085a1d814f28dbe94372f4d3187907eb54616b3befda6ca5c62bd96f8dd66e329", @ANYRES16=0x0, @ANYBLOB="080028bd7000fedbdf2507000000080011000000000005000d0000000000050005000100000008000c000100000005001400bf0000000600030000000000050022000000000006001c0003000000"], 0x54}, 0x1, 0x0, 0x0, 0x4040004}, 0x8804) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r2, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44810}, 0x40000) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="007ed46c6b23a2bdb3001c3900006813e76b0034cdb11d254a0b16f438ebb443f8876c12786f823c2ad30361131df122712813bab6e58efd00000000b27d17da54a398a7489b694bdbf06b64377ff72b22d3cb64ce0f90dd3e37a57721f6fffbf5c4d3d236c5c8f306742453f1672cfb6081de1da47d8040660aac17ea4af5aeee47684a845787db7b30b5660214a5dee5869c61fbaab4bfa1026d99fec77a0a8aa74882f9122e353d89dfbf43a58d0543710b25f652db62aac6f91914ccda1ab5dac915cfc12720929af764d79368cac238bb39141146915059b3e914ef02863cd8edddf458d2db507b2c55abe8e058c3d3639cd8b255e4b3f72ff432014b45ede9630952073290fa9f970957e961a2e775f9a45c9dffc79cc80f957e7a550466c368d79b9797b1c6df23a13518cceaec8583b7172c2347e13153c3cd9720cca8a8096edfa81ec50f8bcaed74a732de0f9bbfe15d8c5a3ed79c5ee6077f9628e42636b3fd89d663afa84e6f5cbf60effb3dcae50247f37450734343ed943a87dd0e03990700a64b4aff"], 0x14}}, 0x0) (async)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x0, 0x1])

04:21:44 executing program 4:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa2}, 0x0)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 4:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa3}, 0x0)

04:21:44 executing program 5:
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000000)={"0a804d5b9b9fb904ac06e80685b6a387e24d7efafebafcbb083546ddccc5", 0xe32, 0x200, 0x3, [0xff, 0xfffffff8, 0x0, 0xfffffff8, 0x9, 0x60, 0x81, 0x3, 0xfffffffb, 0x1ff, 0x7d, 0x0, 0xff, 0x6, 0x0, 0x8, 0x9d2, 0x7]}) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 64)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="57646106ed4bffe22362e3e6a4f1f01946e073cbe8c3c39ddc63249987b970067ea164214e6def38f2222361ae4250798b2708162470d085a1d814f28dbe94372f4d3187907eb54616b3befda6ca5c62bd96f8dd66e329", @ANYRES16=0x0, @ANYBLOB="080028bd7000fedbdf2507000000080011000000000005000d0000000000050005000100000008000c000100000005001400bf0000000600030000000000050022000000000006001c0003000000"], 0x54}, 0x1, 0x0, 0x0, 0x4040004}, 0x8804) (async, rerun: 64)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r2, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44810}, 0x40000) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="007ed46c6b23a2bdb3001c3900006813e76b0034cdb11d254a0b16f438ebb443f8876c12786f823c2ad30361131df122712813bab6e58efd00000000b27d17da54a398a7489b694bdbf06b64377ff72b22d3cb64ce0f90dd3e37a57721f6fffbf5c4d3d236c5c8f306742453f1672cfb6081de1da47d8040660aac17ea4af5aeee47684a845787db7b30b5660214a5dee5869c61fbaab4bfa1026d99fec77a0a8aa74882f9122e353d89dfbf43a58d0543710b25f652db62aac6f91914ccda1ab5dac915cfc12720929af764d79368cac238bb39141146915059b3e914ef02863cd8edddf458d2db507b2c55abe8e058c3d3639cd8b255e4b3f72ff432014b45ede9630952073290fa9f970957e961a2e775f9a45c9dffc79cc80f957e7a550466c368d79b9797b1c6df23a13518cceaec8583b7172c2347e13153c3cd9720cca8a8096edfa81ec50f8bcaed74a732de0f9bbfe15d8c5a3ed79c5ee6077f9628e42636b3fd89d663afa84e6f5cbf60effb3dcae50247f37450734343ed943a87dd0e03990700a64b4aff"], 0x14}}, 0x0)

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x0, 0x1])

04:21:44 executing program 4:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa4}, 0x0)

04:21:44 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000002f04000000"], 0x14}}, 0x0)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000000)=[0x0, 0x1])

04:21:44 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa5}, 0x0)

04:21:44 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000002f04000000"], 0x14}}, 0x0) (async)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:44 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:44 executing program 3:
socket(0x18, 0x0, 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/150)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x51, 0x8001, 0x0, {0x9, 0x100}, {0x7, 0x809b}, @const={0x5, {0x1, 0xe3f3, 0x3, 0xfff7}}})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCSKEYCODE(r3, 0x40084504, &(0x7f00000001c0)=[0xfffffff8])
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000200)=""/80)

04:21:44 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:44 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3549.282644][T31190] binder: 31185:31190 ioctl c0306201 0 returned -14
04:21:45 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa6}, 0x0)

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000002f04000000"], 0x14}}, 0x0)
socket$inet_icmp(0x2, 0x2, 0x1)

04:21:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3549.399879][T31202] binder: 31201:31202 ioctl c0306201 0 returned -14
04:21:45 executing program 3:
socket(0x18, 0x0, 0x0) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/150)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x51, 0x8001, 0x0, {0x9, 0x100}, {0x7, 0x809b}, @const={0x5, {0x1, 0xe3f3, 0x3, 0xfff7}}}) (async, rerun: 32)
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80) (rerun: 32)
ioctl$EVIOCSKEYCODE(r3, 0x40084504, &(0x7f00000001c0)=[0xfffffff8])
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000200)=""/80)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:45 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa7}, 0x0)

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="29a8fde7ea8910fd7411cb2a02687e6bd90f86616c20bbfff9bec0edd8ae90cee67aa0aa65679a32601173f1c3342cd87a964644e357549dd4796c8d1a1d67d3273523a493466152651314", @ANYRES16=0x0, @ANYBLOB="00000000000000000000040008000e59065f1b3730a9ac8507c01b1e5a2a52013ec4ade76a0a39f26a1d86048bc810015e81edef19a8b56d19b3143562d56768f89c971284a12e526466bef550d349cc8f90c4fc668445602a67f7aa8d63ce531bd4920a20e61c61f7e2959501ea00948c93679f26858ee4a7b22b9e8aad5db4e1589416de58a07b69dcdecf18966f7cc2dea3071de98f77a86eeb93d05da57a181e251a3c05410547be7da81ad2c90c192a9c906df399e379aee143c26ea2bc1ac3107c3e80e15d2cbf5e6d99130b8b5a973350aa9bb1268972ec42686c40c3adc06c6221109ac464f5bce9eacd1be6c0e9018bd2ae4c802aa58157bff7b9"], 0x14}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xc183)

04:21:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3549.538626][T31215] binder: 31211:31215 ioctl c0306201 0 returned -14
04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa8}, 0x0)

04:21:45 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 3:
socket(0x18, 0x0, 0x0) (async)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000100)=""/150)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x51, 0x8001, 0x0, {0x9, 0x100}, {0x7, 0x809b}, @const={0x5, {0x1, 0xe3f3, 0x3, 0xfff7}}})
pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCSKEYCODE(r3, 0x40084504, &(0x7f00000001c0)=[0xfffffff8]) (async)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000200)=""/80)

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="29a8fde7ea8910fd7411cb2a02687e6bd90f86616c20bbfff9bec0edd8ae90cee67aa0aa65679a32601173f1c3342cd87a964644e357549dd4796c8d1a1d67d3273523a493466152651314", @ANYRES16=0x0, @ANYBLOB="00000000000000000000040008000e59065f1b3730a9ac8507c01b1e5a2a52013ec4ade76a0a39f26a1d86048bc810015e81edef19a8b56d19b3143562d56768f89c971284a12e526466bef550d349cc8f90c4fc668445602a67f7aa8d63ce531bd4920a20e61c61f7e2959501ea00948c93679f26858ee4a7b22b9e8aad5db4e1589416de58a07b69dcdecf18966f7cc2dea3071de98f77a86eeb93d05da57a181e251a3c05410547be7da81ad2c90c192a9c906df399e379aee143c26ea2bc1ac3107c3e80e15d2cbf5e6d99130b8b5a973350aa9bb1268972ec42686c40c3adc06c6221109ac464f5bce9eacd1be6c0e9018bd2ae4c802aa58157bff7b9"], 0x14}}, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 64)
ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xc183) (rerun: 64)

04:21:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xa9}, 0x0)

04:21:45 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xff, 0x119040)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3])

04:21:45 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\a\x00\x00!', @ANYRES16=r0, @ANYBLOB="00000000000002000000040000009fa14140c90014139bd66f2d8753ddcfbe3e0cb867f0a461b0df0dae4b15b71b5d3da2ba2b87a51d4a7c15f36947ae79ce85c27b9a55"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008001)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x32030414}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004801}, 0x8080)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000129bd7000fbdbdf250400000005000d000100000005001300070000f2396042ac363979f3d9adc494ae1ac94db17241f31b593e7428c1603fc809d733d9e0aec2ffa84432386344091b4e3f6c0af407163479011fa3ae"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x8014)
r4 = syz_open_dev$vcsa(&(0x7f0000000180), 0x101, 0x2c0000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000640)={0x60, r5, 0x521, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff7f}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffb}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4f2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000010)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000126bd7000ffdbff25040000080500120000000000b8d322e4f24246bef47c162cf8504a5d3ba77acd2f3367035157a32e6c718dffcae7a6e09f680e9c0f22fde09f54a58d67d7b293c75debfa8cf2de5dcbaae7692590ce0ff7abac0d48fddfd34eeaa50e9aec1fc3a44279a12dcb1f8d61e02b42d2dbff022a8cac60e5aef78294fdb39c631b6accd13539658c2fc542e933a936bd735edcbd764511d69523c54e5407a1cfa0defcff0ac72a9bf278360e188865497ccfd5"], 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x4000000)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3549.762523][T31242] binder: 31239:31242 ioctl c0306201 0 returned -14
04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xaa}, 0x0)

04:21:45 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async, rerun: 64)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xff, 0x119040) (rerun: 64)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3])

04:21:45 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RLINK(r0, &(0x7f00000002c0)={0x7, 0x47, 0x2}, 0x7)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000000)={0x7, 0x1, 0x400, 0x2e06c08, 0x5, 0x30})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1}], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="29a8fde7ea8910fd7411cb2a02687e6bd90f86616c20bbfff9bec0edd8ae90cee67aa0aa65679a32601173f1c3342cd87a964644e357549dd4796c8d1a1d67d3273523a493466152651314", @ANYRES16=0x0, @ANYBLOB="00000000000000000000040008000e59065f1b3730a9ac8507c01b1e5a2a52013ec4ade76a0a39f26a1d86048bc810015e81edef19a8b56d19b3143562d56768f89c971284a12e526466bef550d349cc8f90c4fc668445602a67f7aa8d63ce531bd4920a20e61c61f7e2959501ea00948c93679f26858ee4a7b22b9e8aad5db4e1589416de58a07b69dcdecf18966f7cc2dea3071de98f77a86eeb93d05da57a181e251a3c05410547be7da81ad2c90c192a9c906df399e379aee143c26ea2bc1ac3107c3e80e15d2cbf5e6d99130b8b5a973350aa9bb1268972ec42686c40c3adc06c6221109ac464f5bce9eacd1be6c0e9018bd2ae4c802aa58157bff7b9"], 0x14}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xc183)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="29a8fde7ea8910fd7411cb2a02687e6bd90f86616c20bbfff9bec0edd8ae90cee67aa0aa65679a32601173f1c3342cd87a964644e357549dd4796c8d1a1d67d3273523a493466152651314", @ANYRES16=0x0, @ANYBLOB="00000000000000000000040008000e59065f1b3730a9ac8507c01b1e5a2a52013ec4ade76a0a39f26a1d86048bc810015e81edef19a8b56d19b3143562d56768f89c971284a12e526466bef550d349cc8f90c4fc668445602a67f7aa8d63ce531bd4920a20e61c61f7e2959501ea00948c93679f26858ee4a7b22b9e8aad5db4e1589416de58a07b69dcdecf18966f7cc2dea3071de98f77a86eeb93d05da57a181e251a3c05410547be7da81ad2c90c192a9c906df399e379aee143c26ea2bc1ac3107c3e80e15d2cbf5e6d99130b8b5a973350aa9bb1268972ec42686c40c3adc06c6221109ac464f5bce9eacd1be6c0e9018bd2ae4c802aa58157bff7b9"], 0x14}}, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xc183) (async)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xab}, 0x0)

04:21:45 executing program 1:
r0 = socket(0xf, 0xa, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="100025bd7000fddbdf25000000e007001800ac1414bb08000b0002000000050014000400000008000b0000d00000000800110000000000140008007767320000000000000000000000000005002200000000"], 0x58}, 0x1, 0x0, 0x0, 0x20000004}, 0x0)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xac}, 0x0)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080))
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000000)={0x5c08, 0x0, 0x5, 0x4, 0x9, 0x2})
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:45 executing program 3:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xff, 0x119040)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x3])

04:21:45 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0x5452, &(0x7f0000000000))

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xad}, 0x0)

04:21:45 executing program 3:
ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448dc, &(0x7f0000000100)="38b160ab32756abd40364007fb7d63ab7679b1875aa5bd81e1f8221ce75b1fd81c3b583e9b73011615fd88f83387ac859cc19d852c550392dd3cef2429e3c27b6a5125")
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x987, 0x204482)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x5, 0x1b, 0x9, 0x4, "4a293df35b40aa190314136841dc8b22820fa4253a57c00e5a5e8ea782d5ff52"})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000180)={0x1, 0x8000, 0x3, 0x0, 0xfff, 0x64e})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x3)

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r0, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, <r1=>0x0, 0x0, 0x0, 0x0, 0x3, 0x3, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x44, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffff8}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x100}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8004}, 0x20000084)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x8}, 0x14}}, 0x0)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 0:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
getgroups(0x3, &(0x7f0000000040)=[<r2=>0xee01, 0x0, 0xee00])
getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00])
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @remote}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)={0x8}, 0x8)

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xae}, 0x0)

04:21:45 executing program 1:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendto$l2tp6(r1, &(0x7f0000000000)="aea206aa9129", 0x6, 0x4001094, &(0x7f0000000040)={0xa, 0x0, 0xf295, @empty, 0x8, 0x4}, 0x20)
sendto$l2tp6(r0, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:45 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r0, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, <r1=>0x0, 0x0, 0x0, 0x0, 0x3, 0x3, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x44, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffff8}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x100}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8004}, 0x20000084)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x8}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r0, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x44, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffff8}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x100}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8004}, 0x20000084) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x8}, 0x14}}, 0x0) (async)

04:21:45 executing program 3:
ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448dc, &(0x7f0000000100)="38b160ab32756abd40364007fb7d63ab7679b1875aa5bd81e1f8221ce75b1fd81c3b583e9b73011615fd88f83387ac859cc19d852c550392dd3cef2429e3c27b6a5125") (async, rerun: 32)
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x987, 0x204482)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x5, 0x1b, 0x9, 0x4, "4a293df35b40aa190314136841dc8b22820fa4253a57c00e5a5e8ea782d5ff52"}) (async, rerun: 32)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (rerun: 32)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000180)={0x1, 0x8000, 0x3, 0x0, 0xfff, 0x64e}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x3)

04:21:45 executing program 0:
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x900)
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)=[0x6, 0xfffffffc])

04:21:45 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x8)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))

04:21:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xaf}, 0x0)

04:21:45 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r0, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, <r1=>0x0, 0x0, 0x0, 0x0, 0x3, 0x3, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x44, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffff8}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x100}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x8004}, 0x20000084) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0x8}, 0x14}}, 0x0)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000}, 0x11)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/38)

04:21:46 executing program 0:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCSABS20(r0, 0x401845e0, &(0x7f0000000000)={0x0, 0x9, 0x2e70, 0x4a, 0x8, 0x1})
r1 = socket$l2tp6(0xa, 0x2, 0x73)
sendto$l2tp6(r1, 0x0, 0x0, 0x8000, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x20)
sendto$l2tp6(r1, 0x0, 0x7a00, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x20)

04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 1)

04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb0}, 0x0)

04:21:46 executing program 3:
ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448dc, &(0x7f0000000100)="38b160ab32756abd40364007fb7d63ab7679b1875aa5bd81e1f8221ce75b1fd81c3b583e9b73011615fd88f83387ac859cc19d852c550392dd3cef2429e3c27b6a5125")
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x987, 0x204482)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x5, 0x1b, 0x9, 0x4, "4a293df35b40aa190314136841dc8b22820fa4253a57c00e5a5e8ea782d5ff52"})
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000180)={0x1, 0x8000, 0x3, 0x0, 0xfff, 0x64e})
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x3)
ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448dc, &(0x7f0000000100)="38b160ab32756abd40364007fb7d63ab7679b1875aa5bd81e1f8221ce75b1fd81c3b583e9b73011615fd88f83387ac859cc19d852c550392dd3cef2429e3c27b6a5125") (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000000), 0x987, 0x204482) (async)
ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0x5, 0x1b, 0x9, 0x4, "4a293df35b40aa190314136841dc8b22820fa4253a57c00e5a5e8ea782d5ff52"}) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000180)={0x1, 0x8000, 0x3, 0x0, 0xfff, 0x64e}) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x3) (async)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

[ 3550.520493][T31324] ERROR: Out of memory at tomoyo_realpath_from_path.
04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 2)

04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb1}, 0x0)

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 1)

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000}, 0x11) (async, rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async, rerun: 32)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/38)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0xe7, 0x0, &(0x7f0000000180)="9ccc5f4a49bc6c368801288e230286852617b180dd548f1d78204ce413de35c0a202417a9a8ada32e47a6a0786da3e0f20e7dad765f399eeace819caeb3aebaae5fe896b99f77f5526391d98445eb01c5249fa453fba9e015b9804d8395a943ddc63ad880def95416f09b46f75c8b6e1d9dc0e05bd98f4fc5b14cd98226d964ff8890be5507c3e38206462575a3a783034c56317daf58f6bb147cd963adf349dd9cfb190f04de6bcb75d783a73baa8412bdd0f2e40122265804419efb49025f19cec892dd0c4166cc1c01efbecbe6df100c7fb79e86cda97fd27ca244e606faee1a0e2f5ce71cf"})

04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 3)

04:21:46 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r2)
write$9p(r0, &(0x7f0000000000)="5c53acf1fd90c512fc4959e648aea57a04ad9820237b57c0dbd527d14ffd98fd722f2e7b87f29dd8651b67f5487d7d394fcb27581806c9", 0x37)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', <r3=>0x0, 0x2f, 0x9, 0x5, 0x2, 0x20, @local, @mcast1, 0x10, 0x1, 0x9, 0x8}})
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0xfe}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000001}, 0x10)
r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x10000)
ioctl$EVIOCSREP(r4, 0xc0189436, &(0x7f0000000080))

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 2)

[ 3550.648350][T31340] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3550.655301][T31344] ERROR: Out of memory at tomoyo_realpath_from_path.
04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb2}, 0x0)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000}, 0x11)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/38)

04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 4)

04:21:46 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r2)
write$9p(r0, &(0x7f0000000000)="5c53acf1fd90c512fc4959e648aea57a04ad9820237b57c0dbd527d14ffd98fd722f2e7b87f29dd8651b67f5487d7d394fcb27581806c9", 0x37) (async)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', <r3=>0x0, 0x2f, 0x9, 0x5, 0x2, 0x20, @local, @mcast1, 0x10, 0x1, 0x9, 0x8}})
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0xfe}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000001}, 0x10)
r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x10000)
ioctl$EVIOCSREP(r4, 0xc0189436, &(0x7f0000000080))

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 3)

[ 3550.766011][T31357] binder: 31355:31357 ioctl c0306201 20000280 returned -12
[ 3550.787198][T31356] ERROR: Out of memory at tomoyo_realpath_from_path.
04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb3}, 0x0)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 1)

04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 5)

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x400)
pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x7)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x7, 0x6e4, 0x9})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', <r4=>0x0})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b400bab7", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000060003000400000006001a004e22000006000300ffff00000800090002000000"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2f, 0x6, 0xfffffe00, 0xfff, 0x1020, r2, 0x9, '\x00', r4, r2, 0x3, 0x5, 0x1}, 0x48)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x200002, 0x0)

04:21:46 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r2)
write$9p(r0, &(0x7f0000000000)="5c53acf1fd90c512fc4959e648aea57a04ad9820237b57c0dbd527d14ffd98fd722f2e7b87f29dd8651b67f5487d7d394fcb27581806c9", 0x37)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', <r3=>0x0, 0x2f, 0x9, 0x5, 0x2, 0x20, @local, @mcast1, 0x10, 0x1, 0x9, 0x8}})
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0xfe}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000001}, 0x10)
r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x10000)
ioctl$EVIOCSREP(r4, 0xc0189436, &(0x7f0000000080))
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r2) (async)
write$9p(r0, &(0x7f0000000000)="5c53acf1fd90c512fc4959e648aea57a04ad9820237b57c0dbd527d14ffd98fd722f2e7b87f29dd8651b67f5487d7d394fcb27581806c9", 0x37) (async)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x2f, 0x9, 0x5, 0x2, 0x20, @local, @mcast1, 0x10, 0x1, 0x9, 0x8}}) (async)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1ff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0xfe}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000001}, 0x10) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x10000) (async)
ioctl$EVIOCSREP(r4, 0xc0189436, &(0x7f0000000080)) (async)

[ 3550.889165][T31367] FAULT_INJECTION: forcing a failure.
[ 3550.889165][T31367] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb4}, 0x0)

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 4)

[ 3550.889199][T31367] CPU: 0 PID: 31367 Comm: syz-executor.1 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 2)

04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb5}, 0x0)

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x400)
pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x7)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x7, 0x6e4, 0x9})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', <r4=>0x0})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b400bab7", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000060003000400000006001a004e22000006000300ffff00000800090002000000"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2f, 0x6, 0xfffffe00, 0xfff, 0x1020, r2, 0x9, '\x00', r4, r2, 0x3, 0x5, 0x1}, 0x48)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x200002, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) (async)
syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x400) (async)
pipe2$watch_queue(&(0x7f0000000240), 0x80) (async)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x7) (async)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x7, 0x6e4, 0x9}) (async)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b400bab7", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000060003000400000006001a004e22000006000300ffff00000800090002000000"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2f, 0x6, 0xfffffe00, 0xfff, 0x1020, r2, 0x9, '\x00', r4, r2, 0x3, 0x5, 0x1}, 0x48) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x200002, 0x0) (async)

[ 3550.889227][T31367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 6)

[ 3550.889242][T31367] Call Trace:
[ 3550.889249][T31367]  <TASK>
[ 3550.889258][T31367]  dump_stack_lvl+0xcd/0x134
04:21:46 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x3ff, 0x4])

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 5)

[ 3550.889296][T31367]  should_fail.cold+0x5/0xa
04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 3)

04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.889341][T31367]  _copy_from_user+0x2a/0x170
[ 3550.889372][T31367]  binder_ioctl+0x560/0x6d80
04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb6}, 0x0)

04:21:46 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f0000000080), 0x3, 0x400) (async)
pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x80)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x7) (async)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x7, 0x6e4, 0x9}) (async)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', <r4=>0x0})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b400bab7", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000060003000400000006001a004e22000006000300ffff00000800090002000000"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2f, 0x6, 0xfffffe00, 0xfff, 0x1020, r2, 0x9, '\x00', r4, r2, 0x3, 0x5, 0x1}, 0x48)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x200002, 0x0)

04:21:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 6)

04:21:46 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async, rerun: 64)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x3ff, 0x4]) (rerun: 64)

[ 3550.889537][T31367]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3550.889576][T31367]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb7}, 0x0)

04:21:46 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 4)

[ 3550.889620][T31367]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3550.889658][T31367]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3550.889708][T31367]  ? binder_thread_write+0x3220/0x3220
04:21:46 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.889742][T31367]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
[ 3550.889776][T31367]  ? do_vfs_ioctl+0x132/0x15c0
[ 3550.889810][T31367]  ? vfs_fileattr_set+0xbe0/0xbe0
[ 3550.889862][T31367]  ? __context_tracking_exit+0xb8/0xe0
04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x3ff, 0x4])

04:21:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000b53a74ddab6426676fcc00c626844f900000000000004000000"], 0x14}}, 0x0)

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 5)

04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb8}, 0x0)

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.889910][T31367]  ? __fget_files+0x286/0x470
[ 3550.889951][T31367]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 3550.889985][T31367]  ? binder_thread_write+0x3220/0x3220
04:21:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000b53a74ddab6426676fcc00c626844f900000000000004000000"], 0x14}}, 0x0)

[ 3550.890024][T31367]  __x64_sys_ioctl+0x193/0x200
[ 3550.890060][T31367]  do_syscall_64+0x35/0xb0
[ 3550.890090][T31367]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x6802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x20, 0x1e, 0x7, 0x7fff, "66be4b898ad556e41519a3c478da846876152ff7ceada2c81f6ff09a7edc2c36"})

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0}) (fail_nth: 6)

04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xb9}, 0x0)

04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.890117][T31367] RIP: 0033:0x7fe31e4890e9
[ 3550.890138][T31367] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000b53a74ddab6426676fcc00c626844f900000000000004000000"], 0x14}}, 0x0)

04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xba}, 0x0)

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x6802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x20, 0x1e, 0x7, 0x7fff, "66be4b898ad556e41519a3c478da846876152ff7ceada2c81f6ff09a7edc2c36"})

04:21:47 executing program 5:
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000000)=""/132)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f00000000c0)={0x800, 0x2f, 0x7fffffff, 0x9, 0x6, 0x5})

[ 3550.890162][T31367] RSP: 002b:00007fe31f546168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3550.890186][T31367] RAX: ffffffffffffffda RBX: 00007fe31e59bf60 RCX: 00007fe31e4890e9
04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.890204][T31367] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xbb}, 0x0)

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.890221][T31367] RBP: 00007fe31f5461d0 R08: 0000000000000000 R09: 0000000000000000
04:21:47 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x6802)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080))
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x20, 0x1e, 0x7, 0x7fff, "66be4b898ad556e41519a3c478da846876152ff7ceada2c81f6ff09a7edc2c36"})
syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x6802) (async)
ioctl$EVIOCSREP(r0, 0xc0189436, &(0x7f0000000080)) (async)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x20, 0x1e, 0x7, 0x7fff, "66be4b898ad556e41519a3c478da846876152ff7ceada2c81f6ff09a7edc2c36"}) (async)

04:21:47 executing program 5:
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000000)=""/132) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f00000000c0)={0x800, 0x2f, 0x7fffffff, 0x9, 0x6, 0x5})

04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.890237][T31367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3550.890254][T31367] R13: 00007ffff03f464f R14: 00007fe31f546300 R15: 0000000000022000
[ 3550.890289][T31367]  </TASK>
04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xbc}, 0x0)

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 5:
ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000000)=""/132)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, &(0x7f00000000c0)={0x800, 0x2f, 0x7fffffff, 0x9, 0x6, 0x5})

04:21:47 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RVERSION(r0, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x80, 0x6, '9P2000'}, 0x13)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000100)={0x15, 0x4a, &(0x7f0000000000)="29884b5299f67bca6e42c6f14d80321b7b74db02a9f0d00be7bb2375a5e397ffbf57e228e468988f713bdd767a835de177c051fa93810952463f01149cb7ac41cf04dc37784fcc7c627a"})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3550.890299][T31367] binder: 31363:31367 ioctl c0306201 20000280 returned -14
[ 3550.934517][T31373] binder: 31368:31373 ioctl c0306201 20000280 returned -12
[ 3550.975945][T31377] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3551.003202][T31378] binder: 31376:31378 ioctl c0306201 20000100 returned -14
04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xbd}, 0x0)

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x26}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x1)

[ 3551.018780][T31383] FAULT_INJECTION: forcing a failure.
[ 3551.018780][T31383] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:47 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RVERSION(r0, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x80, 0x6, '9P2000'}, 0x13)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000100)={0x15, 0x4a, &(0x7f0000000000)="29884b5299f67bca6e42c6f14d80321b7b74db02a9f0d00be7bb2375a5e397ffbf57e228e468988f713bdd767a835de177c051fa93810952463f01149cb7ac41cf04dc37784fcc7c627a"})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RVERSION(r0, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x80, 0x6, '9P2000'}, 0x13) (async)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0) (async)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000100)={0x15, 0x4a, &(0x7f0000000000)="29884b5299f67bca6e42c6f14d80321b7b74db02a9f0d00be7bb2375a5e397ffbf57e228e468988f713bdd767a835de177c051fa93810952463f01149cb7ac41cf04dc37784fcc7c627a"}) (async)
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080)) (async)

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.018813][T31383] CPU: 0 PID: 31383 Comm: syz-executor.1 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xbe}, 0x0)

04:21:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x26}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x1)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x26}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x1) (async)

04:21:47 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.018840][T31383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3551.018855][T31383] Call Trace:
04:21:47 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xbf}, 0x0)

[ 3551.018862][T31383]  <TASK>
[ 3551.018871][T31383]  dump_stack_lvl+0xcd/0x134
[ 3551.018903][T31383]  should_fail.cold+0x5/0xa
04:21:47 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RVERSION(r0, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x80, 0x6, '9P2000'}, 0x13)
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffe, 0x0)
ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000100)={0x15, 0x4a, &(0x7f0000000000)="29884b5299f67bca6e42c6f14d80321b7b74db02a9f0d00be7bb2375a5e397ffbf57e228e468988f713bdd767a835de177c051fa93810952463f01149cb7ac41cf04dc37784fcc7c627a"})
ioctl$EVIOCSREP(r1, 0xc0189436, &(0x7f0000000080))

04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x26}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x1)

[ 3551.018945][T31383]  _copy_to_user+0x2a/0x140
04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.018973][T31383]  binder_ioctl+0x701/0x6d80
[ 3551.019019][T31383]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc0}, 0x0)

04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019053][T31383]  ? tomoyo_path_number_perm+0x24e/0x590
[ 3551.019093][T31383]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3551.019130][T31383]  ? lockdep_hardirqs_on_prepare+0x400/0x400
04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019176][T31383]  ? binder_thread_write+0x3220/0x3220
[ 3551.019212][T31383]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc1}, 0x0)

[ 3551.019246][T31383]  ? do_vfs_ioctl+0x132/0x15c0
[ 3551.019282][T31383]  ? vfs_fileattr_set+0xbe0/0xbe0
04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019340][T31383]  ? __fget_files+0x286/0x470
[ 3551.019378][T31383]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 3551.019410][T31383]  ? binder_thread_write+0x3220/0x3220
[ 3551.019453][T31383]  __x64_sys_ioctl+0x193/0x200
[ 3551.019488][T31383]  do_syscall_64+0x35/0xb0
[ 3551.019520][T31383]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:48 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040850}, 0x8800)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), r2)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x4c, r4, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f0}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x54}, 0x80)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)

04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc2}, 0x0)

04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019545][T31383] RIP: 0033:0x7fe31e4890e9
[ 3551.019564][T31383] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc3}, 0x0)

04:21:48 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x26}}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x1)

04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040850}, 0x8800)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), r2)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x4c, r4, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f0}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x54}, 0x80) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)

[ 3551.019588][T31383] RSP: 002b:00007fe31f546168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3551.019611][T31383] RAX: ffffffffffffffda RBX: 00007fe31e59bf60 RCX: 00007fe31e4890e9
04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc4}, 0x0)

04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019628][T31383] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019644][T31383] RBP: 00007fe31f5461d0 R08: 0000000000000000 R09: 0000000000000000
04:21:48 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async, rerun: 64)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async, rerun: 64)
sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040850}, 0x8800) (async, rerun: 64)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), r2)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x4c, r4, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7f0}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x54}, 0x80)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @empty}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)

04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc5}, 0x0)

04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.019660][T31383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3551.019674][T31383] R13: 00007ffff03f464f R14: 00007fe31f546300 R15: 0000000000022000
04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc6}, 0x0)

[ 3551.019706][T31383]  </TASK>
[ 3551.032388][T31383] binder: 31379:31383 ioctl c0306201 20000280 returned -14
[ 3551.077627][T31387] FAULT_INJECTION: forcing a failure.
[ 3551.077627][T31387] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:48 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046210, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.077660][T31387] CPU: 1 PID: 31387 Comm: syz-executor.0 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:48 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:48 executing program 5:
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f0000000000)=0x7, 0x4)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0xd739, 0x25dfdbf7}, 0x14}}, 0x0)

[ 3551.077688][T31387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc7}, 0x0)

04:21:49 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.077703][T31387] Call Trace:
[ 3551.077709][T31387]  <TASK>
[ 3551.077718][T31387]  dump_stack_lvl+0xcd/0x134
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046210, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 5:
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f0000000000)=0x7, 0x4)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0xd739, 0x25dfdbf7}, 0x14}}, 0x0)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f0000000000)=0x7, 0x4) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0xd739, 0x25dfdbf7}, 0x14}}, 0x0) (async)

[ 3551.077758][T31387]  should_fail.cold+0x5/0xa
[ 3551.077803][T31387]  _copy_from_user+0x2a/0x170
04:21:49 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.077832][T31387]  binder_ioctl+0x560/0x6d80
04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc8}, 0x0)

[ 3551.077878][T31387]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3551.077915][T31387]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 5:
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, &(0x7f0000000000)=0x7, 0x4)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x0, 0xd739, 0x25dfdbf7}, 0x14}}, 0x0)

[ 3551.077956][T31387]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3551.078003][T31387]  ? lockdep_hardirqs_on_prepare+0x400/0x400
04:21:49 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400c620e, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xc9}, 0x0)

[ 3551.078052][T31387]  ? binder_thread_write+0x3220/0x3220
[ 3551.078086][T31387]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000ff4aedbb00000001000000"], 0x14}}, 0x0)

[ 3551.078119][T31387]  ? do_vfs_ioctl+0x132/0x15c0
04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078153][T31387]  ? vfs_fileattr_set+0xbe0/0xbe0
04:21:49 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xca}, 0x0)

04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400c620e, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078223][T31387]  ? __context_tracking_exit+0xb8/0xe0
[ 3551.078271][T31387]  ? __fget_files+0x286/0x470
[ 3551.078310][T31387]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
04:21:49 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000ff4aedbb00000001000000"], 0x14}}, 0x0)

[ 3551.078343][T31387]  ? binder_thread_write+0x3220/0x3220
[ 3551.078380][T31387]  __x64_sys_ioctl+0x193/0x200
04:21:49 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046210, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078416][T31387]  do_syscall_64+0x35/0xb0
[ 3551.078445][T31387]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078471][T31387] RIP: 0033:0x7f9fa3e890e9
04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xcb}, 0x0)

04:21:49 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078492][T31387] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:49 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000ff4aedbb00000001000000"], 0x14}}, 0x0)

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078517][T31387] RSP: 002b:00007f9fa5027168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
04:21:49 executing program 5:
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
select(0x40, &(0x7f0000000240)={0x8, 0x9, 0x1, 0xe7, 0x80000001, 0x100000001, 0x0, 0xfffffffffffffffe}, &(0x7f0000000280)={0xfffffffffffffffc, 0x19fd, 0x5, 0xffffffffffffff00, 0x3, 0x4, 0x80000001, 0xfff}, &(0x7f0000000300)={0x80000001, 0x480000, 0xf5a39b7, 0x80, 0x3, 0x40, 0x800, 0x9}, &(0x7f0000000340)={0x77359400})
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x9, 0x400800)
ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000001c0)=""/93)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
clock_gettime(0x0, &(0x7f0000000980)={<r3=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r3, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r3, @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000ee5b81916bbe09c1804eb6b9ddda414d5c733dd6885c24b6e17480201a2757ba47e2f89616acb27c5748405e217b14948937952133eb5941df9cb73e1def40c184f05d1f1c56db24dcb10df1073614f06228dcbbb048c491d850c7f13c7197a315613eaa76abee5034c5e202221c8e1fa3b503a953599752e85a02"], 0x14}}, 0x20000040)

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xcc}, 0x0)

04:21:49 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078544][T31387] RAX: ffffffffffffffda RBX: 00007f9fa3f9bf60 RCX: 00007f9fa3e890e9
04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078562][T31387] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
[ 3551.078578][T31387] RBP: 00007f9fa50271d0 R08: 0000000000000000 R09: 0000000000000000
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 5:
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140))
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
select(0x40, &(0x7f0000000240)={0x8, 0x9, 0x1, 0xe7, 0x80000001, 0x100000001, 0x0, 0xfffffffffffffffe}, &(0x7f0000000280)={0xfffffffffffffffc, 0x19fd, 0x5, 0xffffffffffffff00, 0x3, 0x4, 0x80000001, 0xfff}, &(0x7f0000000300)={0x80000001, 0x480000, 0xf5a39b7, 0x80, 0x3, 0x40, 0x800, 0x9}, &(0x7f0000000340)={0x77359400}) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x9, 0x400800)
ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000001c0)=""/93) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r3=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r3, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r3, @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000ee5b81916bbe09c1804eb6b9ddda414d5c733dd6885c24b6e17480201a2757ba47e2f89616acb27c5748405e217b14948937952133eb5941df9cb73e1def40c184f05d1f1c56db24dcb10df1073614f06228dcbbb048c491d850c7f13c7197a315613eaa76abee5034c5e202221c8e1fa3b503a953599752e85a02"], 0x14}}, 0x20000040)

04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400c620e, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xcd}, 0x0)

[ 3551.078593][T31387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 3551.078608][T31387] R13: 00007fff4673f15f R14: 00007f9fa5027300 R15: 0000000000022000
04:21:49 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.078641][T31387]  </TASK>
[ 3551.090155][T31387] binder: 31386:31387 ioctl c0306201 20000280 returned -14
04:21:49 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:49 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.112065][T31399] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3551.121500][T31400] binder: 31398:31400 ioctl c0306201 20000100 returned -14
[ 3551.141349][T31407] FAULT_INJECTION: forcing a failure.
04:21:49 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
select(0x40, &(0x7f0000000240)={0x8, 0x9, 0x1, 0xe7, 0x80000001, 0x100000001, 0x0, 0xfffffffffffffffe}, &(0x7f0000000280)={0xfffffffffffffffc, 0x19fd, 0x5, 0xffffffffffffff00, 0x3, 0x4, 0x80000001, 0xfff}, &(0x7f0000000300)={0x80000001, 0x480000, 0xf5a39b7, 0x80, 0x3, 0x40, 0x800, 0x9}, &(0x7f0000000340)={0x77359400}) (async)
r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x9, 0x400800)
ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000001c0)=""/93)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r3=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r3, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r3, @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000ee5b81916bbe09c1804eb6b9ddda414d5c733dd6885c24b6e17480201a2757ba47e2f89616acb27c5748405e217b14948937952133eb5941df9cb73e1def40c184f05d1f1c56db24dcb10df1073614f06228dcbbb048c491d850c7f13c7197a315613eaa76abee5034c5e202221c8e1fa3b503a953599752e85a02"], 0x14}}, 0x20000040)

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xce}, 0x0)

[ 3551.141349][T31407] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 3551.141383][T31407] CPU: 0 PID: 31407 Comm: syz-executor.1 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x8, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc881}, 0x2000)

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x801c581f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.141411][T31407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, 0x0)

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xcf}, 0x0)

[ 3551.141427][T31407] Call Trace:
04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x801c581f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.141434][T31407]  <TASK>
[ 3551.141443][T31407]  dump_stack_lvl+0xcd/0x134
[ 3551.141476][T31407]  should_fail.cold+0x5/0xa
04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, 0x0)

04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}}, 0x0) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x8, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc881}, 0x2000)

[ 3551.141528][T31407]  _copy_to_user+0x2a/0x140
[ 3551.141555][T31407]  simple_read_from_buffer+0xcc/0x160
04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd0}, 0x0)

[ 3551.141601][T31407]  proc_fail_nth_read+0x187/0x220
[ 3551.141648][T31407]  ? proc_exe_link+0x1d0/0x1d0
04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, 0x0)

[ 3551.141686][T31407]  ? security_file_permission+0xab/0xd0
[ 3551.141732][T31407]  ? proc_exe_link+0x1d0/0x1d0
04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}}, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x8, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc881}, 0x2000)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000000)={0xffffffffffffffff, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x80}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}}, 0x0) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x8, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0xc881}, 0x2000) (async)

04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.141769][T31407]  vfs_read+0x1ef/0x5d0
[ 3551.141811][T31407]  ksys_read+0x127/0x250
[ 3551.141846][T31407]  ? vfs_write+0xac0/0xac0
04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd1}, 0x0)

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 3551.141885][T31407]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3551.141933][T31407]  do_syscall_64+0x35/0xb0
04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0xfffffffffffffeae, 0x0, 0x0, 0x20, 0x25dfdbfb}, 0x14}}, 0x0)

04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c620f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.141963][T31407]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3551.141989][T31407] RIP: 0033:0x7fe31e43bc9c
[ 3551.142009][T31407] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd2}, 0x0)

04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.142035][T31407] RSP: 002b:00007fe31f546160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c620f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c6211, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0xfffffffffffffeae, 0x0, 0x0, 0x20, 0x25dfdbfb}, 0x14}}, 0x0)

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd3}, 0x0)

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x801c581f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.142060][T31407] RAX: ffffffffffffffda RBX: 00007fe31e59bf60 RCX: 00007fe31e43bc9c
[ 3551.142078][T31407] RDX: 000000000000000f RSI: 00007fe31f5461e0 RDI: 0000000000000004
[ 3551.142094][T31407] RBP: 00007fe31f5461d0 R08: 0000000000000000 R09: 0000000000000000
04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd4}, 0x0)

04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c6211, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0xfffffffffffffeae, 0x0, 0x0, 0x20, 0x25dfdbfb}, 0x14}}, 0x0)

[ 3551.142111][T31407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd5}, 0x0)

04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.142127][T31407] R13: 00007ffff03f464f R14: 00007fe31f546300 R15: 0000000000022000
04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
openat$cgroup_pressure(r0, &(0x7f00000000c0)='cpu.pressure\x00', 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x14}}, 0x0)

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd6}, 0x0)

[ 3551.142164][T31407]  </TASK>
[ 3551.228898][T31412] FAULT_INJECTION: forcing a failure.
[ 3551.228898][T31412] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:50 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
openat$cgroup_pressure(r0, &(0x7f00000000c0)='cpu.pressure\x00', 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x14}}, 0x0)

04:21:50 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:50 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.228933][T31412] CPU: 0 PID: 31412 Comm: syz-executor.0 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd7}, 0x0)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
openat$cgroup_pressure(r0, &(0x7f00000000c0)='cpu.pressure\x00', 0x2, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x14}}, 0x0)

04:21:51 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.228960][T31412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3551.228973][T31412] Call Trace:
[ 3551.228980][T31412]  <TASK>
[ 3551.228988][T31412]  dump_stack_lvl+0xcd/0x134
[ 3551.229022][T31412]  should_fail.cold+0x5/0xa
[ 3551.229065][T31412]  _copy_to_user+0x2a/0x140
04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c620f, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229092][T31412]  binder_ioctl+0x701/0x6d80
04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd8}, 0x0)

04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000029d25cc3b548ecc92934aed991d5972c54469ba9911e5ba4b4b66f49930a12766f3a2d88efbc4d5ee605642af2413d9e2c5fbe6e5fd59f137a80ec39d5b26e01ac958d637b622d2358bbeffb937c207640e8966bfac7e62e6da9389186d6514399374467670c415ad3f26789b9734c16c61c7219c92be98baf9e35603bbb4f5776"], 0x14}}, 0x0)

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc00c6211, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229135][T31412]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3551.229172][T31412]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000029d25cc3b548ecc92934aed991d5972c54469ba9911e5ba4b4b66f49930a12766f3a2d88efbc4d5ee605642af2413d9e2c5fbe6e5fd59f137a80ec39d5b26e01ac958d637b622d2358bbeffb937c207640e8966bfac7e62e6da9389186d6514399374467670c415ad3f26789b9734c16c61c7219c92be98baf9e35603bbb4f5776"], 0x14}}, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xd9}, 0x0)

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229213][T31412]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3551.229249][T31412]  ? lockdep_hardirqs_on_prepare+0x400/0x400
04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xda}, 0x0)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229295][T31412]  ? binder_thread_write+0x3220/0x3220
[ 3551.229328][T31412]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000029d25cc3b548ecc92934aed991d5972c54469ba9911e5ba4b4b66f49930a12766f3a2d88efbc4d5ee605642af2413d9e2c5fbe6e5fd59f137a80ec39d5b26e01ac958d637b622d2358bbeffb937c207640e8966bfac7e62e6da9389186d6514399374467670c415ad3f26789b9734c16c61c7219c92be98baf9e35603bbb4f5776"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000029d25cc3b548ecc92934aed991d5972c54469ba9911e5ba4b4b66f49930a12766f3a2d88efbc4d5ee605642af2413d9e2c5fbe6e5fd59f137a80ec39d5b26e01ac958d637b622d2358bbeffb937c207640e8966bfac7e62e6da9389186d6514399374467670c415ad3f26789b9734c16c61c7219c92be98baf9e35603bbb4f5776"], 0x14}}, 0x0) (async)

04:21:51 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229361][T31412]  ? do_vfs_ioctl+0x132/0x15c0
[ 3551.229395][T31412]  ? vfs_fileattr_set+0xbe0/0xbe0
04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xdb}, 0x0)

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306215, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229453][T31412]  ? __fget_files+0x286/0x470
04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2fe9a8e8717e917c29fe490254a9a41689c60f00007405d450dc50ce0fda8a9f7fbed14633b91c36eb88cd7ce45a51ccfc4e979c0000000077be73f405d3c06708e521397103f15c616b8cf3c4000000805cc15fe1fbc01d02d08be9ed05f3a11f7b7b1ed4f71efa3b2ad6713474176ca145f7fdc909fca161faf163f6e5b11d1fdc6adde0cc0df87f691e4fc30712c906d2cb3a983474cde8148494ee3c09e1f1bb4327b95b906fb395221f491cf9654373dc09e7278ecaf0e24ba36c796bb8c052ddc1e77dc3627dfe0dcfc66af0959bc81af4c6476fa247c073c2d812e69104bd21bbe11b0f105de886fbceaa0b0c78986e1f0bf11fce833fb49d31f5bdc54e5169e245dbc66c5d65c5cccea70fb32db5bd1f30f7be70f282442f683da64239bec75d7943141ab5cca6b7b71582443a61c5e083cc317a1494d2bd591d85242f641bbe556bcd7c1568cb9b9915e281f6c88d00c0ec5223385e49618ffa48c2a4061b9f67b4f487651fa7d0b839ec96a13bc55d", @ANYRES16=0x0, @ANYBLOB="000200000000000000000400000008000b000400000014004300fc0200000000000000000000000000010600030000000000"], 0x38}}, 0x1)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x15, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2fe9a8e8717e917c29fe490254a9a41689c60f00007405d450dc50ce0fda8a9f7fbed14633b91c36eb88cd7ce45a51ccfc4e979c0000000077be73f405d3c06708e521397103f15c616b8cf3c4000000805cc15fe1fbc01d02d08be9ed05f3a11f7b7b1ed4f71efa3b2ad6713474176ca145f7fdc909fca161faf163f6e5b11d1fdc6adde0cc0df87f691e4fc30712c906d2cb3a983474cde8148494ee3c09e1f1bb4327b95b906fb395221f491cf9654373dc09e7278ecaf0e24ba36c796bb8c052ddc1e77dc3627dfe0dcfc66af0959bc81af4c6476fa247c073c2d812e69104bd21bbe11b0f105de886fbceaa0b0c78986e1f0bf11fce833fb49d31f5bdc54e5169e245dbc66c5d65c5cccea70fb32db5bd1f30f7be70f282442f683da64239bec75d7943141ab5cca6b7b71582443a61c5e083cc317a1494d2bd591d85242f641bbe556bcd7c1568cb9b9915e281f6c88d00c0ec5223385e49618ffa48c2a4061b9f67b4f487651fa7d0b839ec96a13bc55d", @ANYRES16=0x0, @ANYBLOB="000200000000000000000400000008000b000400000014004300fc0200000000000000000000000000010600030000000000"], 0x38}}, 0x1)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2fe9a8e8717e917c29fe490254a9a41689c60f00007405d450dc50ce0fda8a9f7fbed14633b91c36eb88cd7ce45a51ccfc4e979c0000000077be73f405d3c06708e521397103f15c616b8cf3c4000000805cc15fe1fbc01d02d08be9ed05f3a11f7b7b1ed4f71efa3b2ad6713474176ca145f7fdc909fca161faf163f6e5b11d1fdc6adde0cc0df87f691e4fc30712c906d2cb3a983474cde8148494ee3c09e1f1bb4327b95b906fb395221f491cf9654373dc09e7278ecaf0e24ba36c796bb8c052ddc1e77dc3627dfe0dcfc66af0959bc81af4c6476fa247c073c2d812e69104bd21bbe11b0f105de886fbceaa0b0c78986e1f0bf11fce833fb49d31f5bdc54e5169e245dbc66c5d65c5cccea70fb32db5bd1f30f7be70f282442f683da64239bec75d7943141ab5cca6b7b71582443a61c5e083cc317a1494d2bd591d85242f641bbe556bcd7c1568cb9b9915e281f6c88d00c0ec5223385e49618ffa48c2a4061b9f67b4f487651fa7d0b839ec96a13bc55d", @ANYRES16=0x0, @ANYBLOB="000200000000000000000400000008000b000400000014004300fc0200000000000000000000000000010600030000000000"], 0x38}}, 0x1) (async)

[ 3551.229501][T31412]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 3551.229535][T31412]  ? binder_thread_write+0x3220/0x3220
[ 3551.229574][T31412]  __x64_sys_ioctl+0x193/0x200
04:21:51 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306215, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xdc}, 0x0)

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229611][T31412]  do_syscall_64+0x35/0xb0
[ 3551.229643][T31412]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2fe9a8e8717e917c29fe490254a9a41689c60f00007405d450dc50ce0fda8a9f7fbed14633b91c36eb88cd7ce45a51ccfc4e979c0000000077be73f405d3c06708e521397103f15c616b8cf3c4000000805cc15fe1fbc01d02d08be9ed05f3a11f7b7b1ed4f71efa3b2ad6713474176ca145f7fdc909fca161faf163f6e5b11d1fdc6adde0cc0df87f691e4fc30712c906d2cb3a983474cde8148494ee3c09e1f1bb4327b95b906fb395221f491cf9654373dc09e7278ecaf0e24ba36c796bb8c052ddc1e77dc3627dfe0dcfc66af0959bc81af4c6476fa247c073c2d812e69104bd21bbe11b0f105de886fbceaa0b0c78986e1f0bf11fce833fb49d31f5bdc54e5169e245dbc66c5d65c5cccea70fb32db5bd1f30f7be70f282442f683da64239bec75d7943141ab5cca6b7b71582443a61c5e083cc317a1494d2bd591d85242f641bbe556bcd7c1568cb9b9915e281f6c88d00c0ec5223385e49618ffa48c2a4061b9f67b4f487651fa7d0b839ec96a13bc55d", @ANYRES16=0x0, @ANYBLOB="000200000000000000000400000008000b000400000014004300fc0200000000000000000000000000010600030000000000"], 0x38}}, 0x1)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x20, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040080) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2fe9a8e8717e917c29fe490254a9a41689c60f00007405d450dc50ce0fda8a9f7fbed14633b91c36eb88cd7ce45a51ccfc4e979c0000000077be73f405d3c06708e521397103f15c616b8cf3c4000000805cc15fe1fbc01d02d08be9ed05f3a11f7b7b1ed4f71efa3b2ad6713474176ca145f7fdc909fca161faf163f6e5b11d1fdc6adde0cc0df87f691e4fc30712c906d2cb3a983474cde8148494ee3c09e1f1bb4327b95b906fb395221f491cf9654373dc09e7278ecaf0e24ba36c796bb8c052ddc1e77dc3627dfe0dcfc66af0959bc81af4c6476fa247c073c2d812e69104bd21bbe11b0f105de886fbceaa0b0c78986e1f0bf11fce833fb49d31f5bdc54e5169e245dbc66c5d65c5cccea70fb32db5bd1f30f7be70f282442f683da64239bec75d7943141ab5cca6b7b71582443a61c5e083cc317a1494d2bd591d85242f641bbe556bcd7c1568cb9b9915e281f6c88d00c0ec5223385e49618ffa48c2a4061b9f67b4f487651fa7d0b839ec96a13bc55d", @ANYRES16=0x0, @ANYBLOB="000200000000000000000400000008000b000400000014004300fc0200000000000000000000000000010600030000000000"], 0x38}}, 0x1) (async)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x15, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xdd}, 0x0)

[ 3551.229669][T31412] RIP: 0033:0x7f9fa3e890e9
[ 3551.229688][T31412] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 5:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x511040)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000180)=""/188)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xfc, 0xf, 0x20, 0x7, "ea41831ef406f12fffbcf9f65ab74b954eed973f7c3050a53651ba8a72b68713"})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="000000000000006fb222dbf281f63d93d411c8a2f14839d3010eb81a09d8c038d5523dc1044a7af99db48884334c10b8fdda6ff8c4a130553e96301e2414d64d7cd4", @ANYRES16=0x0, @ANYBLOB="0000000900105c733a00003aae9cbede20ed2cd96fcf03b8467938142ac54c51476cc69f4e5580758328880102007c4436e017c1d509a73e166d8a9382bb243577a111a851f1010000007cea6df28eaa01310e20f9c3e5f82c93852f54848c975f8a"], 0x4}}, 0x4)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000380)=""/66)
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x3d}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x5)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xde}, 0x0)

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 5:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x511040)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000180)=""/188)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xfc, 0xf, 0x20, 0x7, "ea41831ef406f12fffbcf9f65ab74b954eed973f7c3050a53651ba8a72b68713"})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="000000000000006fb222dbf281f63d93d411c8a2f14839d3010eb81a09d8c038d5523dc1044a7af99db48884334c10b8fdda6ff8c4a130553e96301e2414d64d7cd4", @ANYRES16=0x0, @ANYBLOB="0000000900105c733a00003aae9cbede20ed2cd96fcf03b8467938142ac54c51476cc69f4e5580758328880102007c4436e017c1d509a73e166d8a9382bb243577a111a851f1010000007cea6df28eaa01310e20f9c3e5f82c93852f54848c975f8a"], 0x4}}, 0x4)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000380)=""/66)
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x3d}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x5)
syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x511040) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000180)=""/188) (async)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xfc, 0xf, 0x20, 0x7, "ea41831ef406f12fffbcf9f65ab74b954eed973f7c3050a53651ba8a72b68713"}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="000000000000006fb222dbf281f63d93d411c8a2f14839d3010eb81a09d8c038d5523dc1044a7af99db48884334c10b8fdda6ff8c4a130553e96301e2414d64d7cd4", @ANYRES16=0x0, @ANYBLOB="0000000900105c733a00003aae9cbede20ed2cd96fcf03b8467938142ac54c51476cc69f4e5580758328880102007c4436e017c1d509a73e166d8a9382bb243577a111a851f1010000007cea6df28eaa01310e20f9c3e5f82c93852f54848c975f8a"], 0x4}}, 0x4) (async)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000380)=""/66) (async)
pipe2$watch_queue(&(0x7f0000000080), 0x80) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x3d}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x5) (async)

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xdf}, 0x0)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229712][T31412] RSP: 002b:00007f9fa5027168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3551.229735][T31412] RAX: ffffffffffffffda RBX: 00007f9fa3f9bf60 RCX: 00007f9fa3e890e9
04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe0}, 0x0)

04:21:51 executing program 5:
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x511040)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000180)=""/188) (async, rerun: 32)
ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xfc, 0xf, 0x20, 0x7, "ea41831ef406f12fffbcf9f65ab74b954eed973f7c3050a53651ba8a72b68713"}) (async, rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="000000000000006fb222dbf281f63d93d411c8a2f14839d3010eb81a09d8c038d5523dc1044a7af99db48884334c10b8fdda6ff8c4a130553e96301e2414d64d7cd4", @ANYRES16=0x0, @ANYBLOB="0000000900105c733a00003aae9cbede20ed2cd96fcf03b8467938142ac54c51476cc69f4e5580758328880102007c4436e017c1d509a73e166d8a9382bb243577a111a851f1010000007cea6df28eaa01310e20f9c3e5f82c93852f54848c975f8a"], 0x4}}, 0x4) (async)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000380)=""/66) (async)
pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x3d}}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x5)

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306215, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229753][T31412] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
[ 3551.229768][T31412] RBP: 00007f9fa50271d0 R08: 0000000000000000 R09: 0000000000000000
04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 5:
write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x2710}, 0x3, 0x7ff, 0x8}, {{}, 0x16, 0x3b, 0x1}, {{0x77359400}, 0x14, 0x6, 0x1}], 0x48)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe1}, 0x0)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.229784][T31412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x15, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 5:
write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x2710}, 0x3, 0x7ff, 0x8}, {{}, 0x16, 0x3b, 0x1}, {{0x77359400}, 0x14, 0x6, 0x1}], 0x48)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0)
write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x2710}, 0x3, 0x7ff, 0x8}, {{}, 0x16, 0x3b, 0x1}, {{0x77359400}, 0x14, 0x6, 0x1}], 0x48) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) (async)

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe2}, 0x0)

[ 3551.229799][T31412] R13: 00007fff4673f15f R14: 00007f9fa5027300 R15: 0000000000022000
[ 3551.229831][T31412]  </TASK>
[ 3551.229840][T31412] binder: 31410:31412 ioctl c0306201 20000280 returned -14
04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 5:
write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x2710}, 0x3, 0x7ff, 0x8}, {{}, 0x16, 0x3b, 0x1}, {{0x77359400}, 0x14, 0x6, 0x1}], 0x48)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0)
write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x2710}, 0x3, 0x7ff, 0x8}, {{}, 0x16, 0x3b, 0x1}, {{0x77359400}, 0x14, 0x6, 0x1}], 0x48) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) (async)

04:21:51 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe3}, 0x0)

04:21:51 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.282901][T31416] binder: 31415:31416 ioctl c0306201 20000280 returned -12
[ 3551.353010][T31424] FAULT_INJECTION: forcing a failure.
[ 3551.353010][T31424] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:51 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:51 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)

04:21:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe4}, 0x0)

04:21:51 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x80}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ELP_INTERVAL={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008000}, 0x44080)

[ 3551.353047][T31424] CPU: 1 PID: 31424 Comm: syz-executor.0 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe5}, 0x0)

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353078][T31424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353094][T31424] Call Trace:
04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x80}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ELP_INTERVAL={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008000}, 0x44080)

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe6}, 0x0)

04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[ 3551.353101][T31424]  <TASK>
[ 3551.353111][T31424]  dump_stack_lvl+0xcd/0x134
[ 3551.353148][T31424]  should_fail.cold+0x5/0xa
04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x80}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ELP_INTERVAL={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008000}, 0x44080)

[ 3551.353194][T31424]  _copy_to_user+0x2a/0x140
04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe7}, 0x0)

[ 3551.353224][T31424]  simple_read_from_buffer+0xcc/0x160
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$bt_cmtp(0x1f, 0x3, 0x5)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe8}, 0x0)

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x1000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353269][T31424]  proc_fail_nth_read+0x187/0x220
[ 3551.353314][T31424]  ? proc_exe_link+0x1d0/0x1d0
[ 3551.353353][T31424]  ? security_file_permission+0xab/0xd0
[ 3551.353400][T31424]  ? proc_exe_link+0x1d0/0x1d0
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xe9}, 0x0)

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$bt_cmtp(0x1f, 0x3, 0x5) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353437][T31424]  vfs_read+0x1ef/0x5d0
[ 3551.353478][T31424]  ksys_read+0x127/0x250
[ 3551.353514][T31424]  ? vfs_write+0xac0/0xac0
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x1000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$bt_cmtp(0x1f, 0x3, 0x5) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xea}, 0x0)

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353553][T31424]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3551.353601][T31424]  do_syscall_64+0x35/0xb0
[ 3551.353632][T31424]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xeb}, 0x0)

04:21:52 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353660][T31424] RIP: 0033:0x7f9fa3e3bc9c
[ 3551.353681][T31424] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
04:21:52 executing program 5:
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x9, 0x100)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000080)=""/222)

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x9, 0x100)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000080)=""/222)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
syz_open_dev$evdev(&(0x7f0000000040), 0x9, 0x100) (async)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000080)=""/222) (async)

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xec}, 0x0)

[ 3551.353708][T31424] RSP: 002b:00007f9fa5027160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353734][T31424] RAX: ffffffffffffffda RBX: 00007f9fa3f9bf60 RCX: 00007f9fa3e3bc9c
[ 3551.353752][T31424] RDX: 000000000000000f RSI: 00007f9fa50271e0 RDI: 0000000000000004
04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xed}, 0x0)

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x9, 0x100)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000080)=""/222)

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x1000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353770][T31424] RBP: 00007f9fa50271d0 R08: 0000000000000000 R09: 0000000000000000
[ 3551.353786][T31424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xee}, 0x0)

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0000000000040100000000000000"], 0x14}}, 0x0)

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x2000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353802][T31424] R13: 00007fff4673f15f R14: 00007f9fa5027300 R15: 0000000000022000
04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xef}, 0x0)

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0000000000040100000000000000"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0000000000040100000000000000"], 0x14}}, 0x0) (async)

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.353838][T31424]  </TASK>
[ 3551.414955][T31432] FAULT_INJECTION: forcing a failure.
[ 3551.414955][T31432] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x3000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.414989][T31432] CPU: 0 PID: 31432 Comm: syz-executor.4 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf0}, 0x0)

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0000000000040100000000000000"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0000000000040100000000000000"], 0x14}}, 0x0) (async)

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415018][T31432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf1}, 0x0)

04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415033][T31432] Call Trace:
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x4000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfffffdfd, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf2}, 0x0)

04:21:52 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfffffdfd, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x700, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415039][T31432]  <TASK>
[ 3551.415049][T31432]  dump_stack_lvl+0xcd/0x134
[ 3551.415087][T31432]  should_fail.cold+0x5/0xa
[ 3551.415133][T31432]  _copy_from_user+0x2a/0x170
04:21:52 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x5000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:52 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3551.415162][T31432]  binder_ioctl+0x560/0x6d80
04:21:52 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x100000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf3}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x100000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x6000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 3551.415208][T31432]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3551.415243][T31432]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x200000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf4}, 0x0)

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x7000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x200000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415284][T31432]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3551.415322][T31432]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3551.415371][T31432]  ? binder_thread_write+0x3220/0x3220
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x7, 0x1, {0x6, '{,\':}{'}}, 0xf)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0xce6d410424b238aa)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/87)

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf5}, 0x0)

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 3551.415404][T31432]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
[ 3551.415438][T31432]  ? do_vfs_ioctl+0x132/0x15c0
[ 3551.415480][T31432]  ? vfs_fileattr_set+0xbe0/0xbe0
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x400000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf6}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x7, 0x1, {0x6, '{,\':}{'}}, 0xf)
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async, rerun: 32)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0xce6d410424b238aa) (async, rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/87)

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415533][T31432]  ? __context_tracking_exit+0xb8/0xe0
[ 3551.415585][T31432]  ? __fget_files+0x286/0x470
[ 3551.415627][T31432]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x400000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf7}, 0x0)

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415662][T31432]  ? binder_thread_write+0x3220/0x3220
[ 3551.415700][T31432]  __x64_sys_ioctl+0x193/0x200
[ 3551.415737][T31432]  do_syscall_64+0x35/0xb0
04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfffffdfd, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf8}, 0x0)

04:21:53 executing program 5:
write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x7, 0x1, {0x6, '{,\':}{'}}, 0xf) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0xce6d410424b238aa) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000140)=""/87)

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, 0x0, 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415767][T31432]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3551.415795][T31432] RIP: 0033:0x7f9cd88890e9
04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x100000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xf9}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x180, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast1}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="e9e10c9c431e87690000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x50, r2, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x7f}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

[ 3551.415816][T31432] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x700, &(0x7f0000000140)=[@free_buffer], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x200000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xfa}, 0x0)

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, &(0x7f0000000140), 0x0, 0x0, 0x0})

[ 3551.415841][T31432] RSP: 002b:00007f9cd99f4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff00000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x180, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast1}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="e9e10c9c431e87690000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x50, r2, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x7f}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x300000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415867][T31432] RAX: ffffffffffffffda RBX: 00007f9cd899bf60 RCX: 00007f9cd88890e9
04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xfb}, 0x0)

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x400000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x180, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast1}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="e9e10c9c431e87690000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x50, r2, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x7f}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, &(0x7f0000000140), 0x0, 0x0, 0x0})

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff00000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.415886][T31432] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
[ 3551.415902][T31432] RBP: 00007f9cd99f41d0 R08: 0000000000000000 R09: 0000000000000000
04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xfc}, 0x0)

[ 3551.415918][T31432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:53 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x700, &(0x7f0000000140), 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x500000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630b}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xfd}, 0x0)

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="55e3b7f1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3551.415934][T31432] R13: 00007ffca437a12f R14: 00007f9cd99f4300 R15: 0000000000022000
[ 3551.415968][T31432]  </TASK>
04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="55e3b7f1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="55e3b7f1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (async)

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x600000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630c}, @release], 0x0, 0x0, 0x0})

[ 3551.417444][T31432] binder: 31430:31432 ioctl c0306201 20000280 returned -14
[ 3551.536271][T31442] FAULT_INJECTION: forcing a failure.
04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0xfe}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630b}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="55e3b7f1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x102}, 0x0)

[ 3551.536271][T31442] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630d}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x700000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x14, 0x0, 0x10, 0x70bd05}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630c}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046302}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xfdfdffff00000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3551.536306][T31442] CPU: 1 PID: 31442 Comm: syz-executor.4 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
[ 3551.536335][T31442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:53 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:53 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x14, 0x0, 0x10, 0x70bd05}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x14, 0x0, 0x10, 0x70bd05}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async)

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x103}, 0x0)

04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630d}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0xff00000000000000, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046304}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630b}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x104}, 0x0)

[ 3551.536350][T31442] Call Trace:
[ 3551.536357][T31442]  <TASK>
[ 3551.536366][T31442]  dump_stack_lvl+0xcd/0x134
[ 3551.536401][T31442]  should_fail.cold+0x5/0xa
04:21:53 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046302}, @release], 0x0, 0x0, 0x0})

04:21:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x105}, 0x0)

04:21:53 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)

[ 3551.536443][T31442]  _copy_to_user+0x2a/0x140
04:21:53 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046307}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x14, 0x0, 0x10, 0x70bd05}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630c}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046304}, @release], 0x0, 0x0, 0x0})

[ 3551.536475][T31442]  binder_ioctl+0x701/0x6d80
[ 3551.536518][T31442]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3551.536553][T31442]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086302}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x106}, 0x0)

04:21:54 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x48080}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x630d}, @release], 0x0, 0x0, 0x0})

[ 3551.536596][T31442]  ? tomoyo_execute_permission+0x4a0/0x4a0
04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}, {&(0x7f0000000380)='~', 0x1, 0xec32}], 0x0, 0x0)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046307}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x107}, 0x0)

[ 3551.536633][T31442]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3551.536679][T31442]  ? binder_thread_write+0x3220/0x3220
04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086307}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x48080}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x48080}, 0x0) (async)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046302}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086302}, @release], 0x0, 0x0, 0x0})

[ 3551.536712][T31442]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
[ 3551.536744][T31442]  ? do_vfs_ioctl+0x132/0x15c0
04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x4008630a}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x48080}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046304}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x108}, 0x0)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086307}, @release], 0x0, 0x0, 0x0})

[ 3551.536778][T31442]  ? vfs_fileattr_set+0xbe0/0xbe0
[ 3551.536839][T31442]  ? __fget_files+0x286/0x470
[ 3551.536878][T31442]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 3551.536911][T31442]  ? binder_thread_write+0x3220/0x3220
04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086310}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40046307}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x1f, 0x1, &(0x7f0000000000)="a9"})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x4008630a}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x109}, 0x0)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086312}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x1f, 0x1, &(0x7f0000000000)="a9"}) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086315}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086302}, @release], 0x0, 0x0, 0x0})

[ 3551.536957][T31442]  __x64_sys_ioctl+0x193/0x200
[ 3551.536996][T31442]  do_syscall_64+0x35/0xb0
[ 3551.537032][T31442]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3551.537058][T31442] RIP: 0033:0x7f9cd88890e9
04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086310}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10a}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086307}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000040)={0x1f, 0x1, &(0x7f0000000000)="a9"})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3551.537078][T31442] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086312}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10b}, 0x0)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086315}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x4008630a}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630f}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x4000000000000000, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RREAD(r0, &(0x7f0000000000)={0xf1, 0x75, 0x2, {0xe6, "4bf44c7fd5eb035c6a8515e8c70091de0894db87dbbc5c02c9288e10f275e3345f111942fe6408717c42bddc6bdc300e2a93768bd184f8a59199b1f096e1b566e1a5d8e6ef6023ff05aab562a6fe3924d2966cf4f54c3d59b0cf2108cf47db70ab542bf30e98fd729c38b3ebc7821c38c478e37ffbf329f4c2970b219fcdf86bdc87dece7800c6281ccbbd080eb0dcb678f236aba9e52c7d664349a236b98a6ad2fb57040f97ca0190f1369be15392bcfa3d0054ebcf77bc4499c6bfc4a44f35f20b5a97b612483a832eedd45e2b48471b0e0ca0cbe3e49372fc72f35aa91919c754baec2b36"}}, 0xf1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x1, &(0x7f00000003c0)=[{&(0x7f00000002c0)="85", 0x1}], 0x0, 0x0)

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10c}, 0x0)

[ 3551.537103][T31442] RSP: 002b:00007f9cd99f4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3551.537127][T31442] RAX: ffffffffffffffda RBX: 00007f9cd899bf60 RCX: 00007f9cd88890e9
04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086310}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106308}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x4000000000000000, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RREAD(r0, &(0x7f0000000000)={0xf1, 0x75, 0x2, {0xe6, "4bf44c7fd5eb035c6a8515e8c70091de0894db87dbbc5c02c9288e10f275e3345f111942fe6408717c42bddc6bdc300e2a93768bd184f8a59199b1f096e1b566e1a5d8e6ef6023ff05aab562a6fe3924d2966cf4f54c3d59b0cf2108cf47db70ab542bf30e98fd729c38b3ebc7821c38c478e37ffbf329f4c2970b219fcdf86bdc87dece7800c6281ccbbd080eb0dcb678f236aba9e52c7d664349a236b98a6ad2fb57040f97ca0190f1369be15392bcfa3d0054ebcf77bc4499c6bfc4a44f35f20b5a97b612483a832eedd45e2b48471b0e0ca0cbe3e49372fc72f35aa91919c754baec2b36"}}, 0xf1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x4000000000000000, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RREAD(r0, &(0x7f0000000000)={0xf1, 0x75, 0x2, {0xe6, "4bf44c7fd5eb035c6a8515e8c70091de0894db87dbbc5c02c9288e10f275e3345f111942fe6408717c42bddc6bdc300e2a93768bd184f8a59199b1f096e1b566e1a5d8e6ef6023ff05aab562a6fe3924d2966cf4f54c3d59b0cf2108cf47db70ab542bf30e98fd729c38b3ebc7821c38c478e37ffbf329f4c2970b219fcdf86bdc87dece7800c6281ccbbd080eb0dcb678f236aba9e52c7d664349a236b98a6ad2fb57040f97ca0190f1369be15392bcfa3d0054ebcf77bc4499c6bfc4a44f35f20b5a97b612483a832eedd45e2b48471b0e0ca0cbe3e49372fc72f35aa91919c754baec2b36"}}, 0xf1) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 3:
syz_mount_image$qnx6(0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0)

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10d}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086312}, @release], 0x0, 0x0, 0x0})

[ 3551.537145][T31442] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000003
[ 3551.537162][T31442] RBP: 00007f9cd99f41d0 R08: 0000000000000000 R09: 0000000000000000
04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630f}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x4000000000000000, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
write$P9_RREAD(r0, &(0x7f0000000000)={0xf1, 0x75, 0x2, {0xe6, "4bf44c7fd5eb035c6a8515e8c70091de0894db87dbbc5c02c9288e10f275e3345f111942fe6408717c42bddc6bdc300e2a93768bd184f8a59199b1f096e1b566e1a5d8e6ef6023ff05aab562a6fe3924d2966cf4f54c3d59b0cf2108cf47db70ab542bf30e98fd729c38b3ebc7821c38c478e37ffbf329f4c2970b219fcdf86bdc87dece7800c6281ccbbd080eb0dcb678f236aba9e52c7d664349a236b98a6ad2fb57040f97ca0190f1369be15392bcfa3d0054ebcf77bc4499c6bfc4a44f35f20b5a97b612483a832eedd45e2b48471b0e0ca0cbe3e49372fc72f35aa91919c754baec2b36"}}, 0xf1)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x4000000000000000, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
write$P9_RREAD(r0, &(0x7f0000000000)={0xf1, 0x75, 0x2, {0xe6, "4bf44c7fd5eb035c6a8515e8c70091de0894db87dbbc5c02c9288e10f275e3345f111942fe6408717c42bddc6bdc300e2a93768bd184f8a59199b1f096e1b566e1a5d8e6ef6023ff05aab562a6fe3924d2966cf4f54c3d59b0cf2108cf47db70ab542bf30e98fd729c38b3ebc7821c38c478e37ffbf329f4c2970b219fcdf86bdc87dece7800c6281ccbbd080eb0dcb678f236aba9e52c7d664349a236b98a6ad2fb57040f97ca0190f1369be15392bcfa3d0054ebcf77bc4499c6bfc4a44f35f20b5a97b612483a832eedd45e2b48471b0e0ca0cbe3e49372fc72f35aa91919c754baec2b36"}}, 0xf1) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106309}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10e}, 0x0)

[ 3551.537179][T31442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086315}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406300}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106308}, @release], 0x0, 0x0, 0x0})

[ 3551.537195][T31442] R13: 00007ffca437a12f R14: 00007f9cd99f4300 R15: 0000000000022000
[ 3551.537230][T31442]  </TASK>
[ 3551.543680][T31443] binder: 31439:31443 ioctl 10 20000280 returned -22
04:21:54 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xce23}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4ea}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x91}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa8a4}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0xa010)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f0000000280), 0x3, 0x1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48800}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r3, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_hsr\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4000084)

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x10f}, 0x0)

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106309}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xce23}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4ea}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x91}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa8a4}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0xa010)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f0000000280), 0x3, 0x1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48800}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r3, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_hsr\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4000084)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xce23}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4ea}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x91}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa8a4}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0xa010) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_open_dev$vcsa(&(0x7f0000000280), 0x3, 0x1) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48800}, 0x40) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r3, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_hsr\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4000084) (async)

[ 3551.546816][T31442] binder: 31440:31442 ioctl c0306201 20000280 returned -14
[ 3551.689457][T31458] FAULT_INJECTION: forcing a failure.
[ 3551.689457][T31458] name fail_usercopy, interval 1, probability 0, space 0, times 0
04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x110}, 0x0)

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406301}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630f}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406300}, @release], 0x0, 0x0, 0x0})

[ 3551.689490][T31458] CPU: 1 PID: 31458 Comm: syz-executor.4 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x111}, 0x0)

04:21:54 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106308}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486311}, @release], 0x0, 0x0, 0x0})

[ 3551.689518][T31458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:54 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xce23}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4ea}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x91}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa8a4}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0xa010) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f0000000280), 0x3, 0x1)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
r4 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r4) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x1f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48800}, 0x40)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r3, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_hsr\x00'}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4000084)

04:21:54 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406301}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x112}, 0x0)

04:21:54 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:54 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40106309}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486312}, @release], 0x0, 0x0, 0x0})

[ 3551.689534][T31458] Call Trace:
[ 3551.689541][T31458]  <TASK>
[ 3551.689550][T31458]  dump_stack_lvl+0xcd/0x134
[ 3551.689586][T31458]  should_fail.cold+0x5/0xa
[ 3551.689630][T31458]  _copy_to_user+0x2a/0x140
04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486311}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)

04:21:55 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x113}, 0x0)

[ 3551.689658][T31458]  simple_read_from_buffer+0xcc/0x160
04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406300}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630b}], 0x0, 0x0, 0x0})

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486312}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40406301}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)

[ 3551.689702][T31458]  proc_fail_nth_read+0x187/0x220
[ 3551.689744][T31458]  ? proc_exe_link+0x1d0/0x1d0
04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630c}], 0x0, 0x0, 0x0})

[ 3551.689782][T31458]  ? security_file_permission+0xab/0xd0
[ 3551.689828][T31458]  ? proc_exe_link+0x1d0/0x1d0
04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630b}], 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x114}, 0x0)

[ 3551.689863][T31458]  vfs_read+0x1ef/0x5d0
04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async)

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630d}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486311}, @release], 0x0, 0x0, 0x0})

[ 3551.689910][T31458]  ksys_read+0x127/0x250
[ 3551.689958][T31458]  ? vfs_write+0xac0/0xac0
04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x115}, 0x0)

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630c}], 0x0, 0x0, 0x0})

[ 3551.689999][T31458]  ? syscall_enter_from_user_mode+0x21/0x70
[ 3551.690048][T31458]  do_syscall_64+0x35/0xb0
04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x40486312}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046302}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00000048a399ad006225f4c6e063"], 0x14}}, 0x20048044)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="b5091011d8788b23b76b5c1fc9da66", @ANYRES16=0x0, @ANYBLOB="20002bbd7000ffdbdf250600000006000e0008000000080009000200000008000c0003000000"], 0x2c}, 0x1, 0x0, 0x0, 0x400c005}, 0x20008000)
r1 = syz_open_dev$vcsa(&(0x7f0000000540), 0x4000000000, 0x8000)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0xfffe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040002}, 0x4008000)
openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0], ""/16, <r2=>0x0, 0x0, 0x0, 0x0, 0x4, 0x2, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x5c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x40005)

[ 3551.690079][T31458]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3551.690105][T31458] RIP: 0033:0x7f9cd883bc9c
04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630d}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630b}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00000048a399ad006225f4c6e063"], 0x14}}, 0x20048044) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="b5091011d8788b23b76b5c1fc9da66", @ANYRES16=0x0, @ANYBLOB="20002bbd7000ffdbdf250600000006000e0008000000080009000200000008000c0003000000"], 0x2c}, 0x1, 0x0, 0x0, 0x400c005}, 0x20008000)
r1 = syz_open_dev$vcsa(&(0x7f0000000540), 0x4000000000, 0x8000)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0xfffe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040002}, 0x4008000) (async)
openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0], ""/16, <r2=>0x0, 0x0, 0x0, 0x0, 0x4, 0x2, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x5c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x40005)

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x116}, 0x0)

[ 3551.690125][T31458] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00000048a399ad006225f4c6e063"], 0x14}}, 0x20048044) (async, rerun: 32)
sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="b5091011d8788b23b76b5c1fc9da66", @ANYRES16=0x0, @ANYBLOB="20002bbd7000ffdbdf250600000006000e0008000000080009000200000008000c0003000000"], 0x2c}, 0x1, 0x0, 0x0, 0x400c005}, 0x20008000) (async, rerun: 32)
r1 = syz_open_dev$vcsa(&(0x7f0000000540), 0x4000000000, 0x8000)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0xfffe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040002}, 0x4008000) (async)
openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) (async)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0], ""/16, <r2=>0x0, 0x0, 0x0, 0x0, 0x4, 0x2, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], 0x0, 0x8, &(0x7f0000000100)=[{}, {}], 0x10, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x10, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x5c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x40005)

04:21:55 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046304}], 0x0, 0x0, 0x0})

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046302}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630c}], 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x117}, 0x0)

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046304}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

[ 3551.690150][T31458] RSP: 002b:00007f9cd99f4160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 3551.690175][T31458] RAX: ffffffffffffffda RBX: 00007f9cd899bf60 RCX: 00007f9cd883bc9c
04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046307}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x630d}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000000)=0x7)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r2, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast2}}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010101}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000004}, 0x4000040)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38160400", @ANYRES16=r2, @ANYBLOB="00082cbd7000fddbdf250800000006001a004e2000000c000f000900000000000000050013003f0000000500040004000000"], 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000340)=""/217)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000fedb5f2504000000"], 0x14}}, 0x4000)

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x118}, 0x0)

[ 3551.690192][T31458] RDX: 000000000000000f RSI: 00007f9cd99f41e0 RDI: 0000000000000004
04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046307}], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046312}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}, @release], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000000)=0x7) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r2, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast2}}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010101}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000004}, 0x4000040)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38160400", @ANYRES16=r2, @ANYBLOB="00082cbd7000fddbdf250800000006001a004e2000000c000f000900000000000000050013003f0000000500040004000000"], 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000340)=""/217) (async, rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000fedb5f2504000000"], 0x14}}, 0x4000) (rerun: 32)

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046302}], 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x119}, 0x0)

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046315}], 0x0, 0x0, 0x0})

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046312}], 0x0, 0x0, 0x0})

[ 3551.690207][T31458] RBP: 00007f9cd99f41d0 R08: 0000000000000000 R09: 0000000000000000
[ 3551.690222][T31458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11a}, 0x0)

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046304}], 0x0, 0x0, 0x0})

[ 3551.690237][T31458] R13: 00007ffca437a12f R14: 00007f9cd99f4300 R15: 0000000000022000
04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086303}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000000)=0x7)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0)
sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x50, r2, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x9}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast2}}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @rand_addr=0x64010101}]}, 0x50}, 0x1, 0x0, 0x0, 0x10000004}, 0x4000040) (async)
sendmsg$L2TP_CMD_SESSION_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38160400", @ANYRES16=r2, @ANYBLOB="00082cbd7000fddbdf250800000006001a004e2000000c000f000900000000000000050013003f0000000500040004000000"], 0x38}, 0x1, 0x0, 0x0, 0x20000800}, 0x24000000)
r3 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r3) (async)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000340)=""/217)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000fedb5f2504000000"], 0x14}}, 0x4000)

04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046315}], 0x0, 0x0, 0x0})

[ 3551.690272][T31458]  </TASK>
[ 3551.693976][T31459] binder: 31452:31459 ioctl 541b 20000280 returned -22
04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x4008630a}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046307}], 0x0, 0x0, 0x0})

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086303}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 3551.759035][T31463] binder: 31461:31463 ioctl 10 20000280 returned -22
[ 3551.857165][T31475] binder: 31474:31475 ioctl 541b 20000280 returned -22
04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11b}, 0x0)

04:21:55 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11c}, 0x0)

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086310}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046312}], 0x0, 0x0, 0x0})

[ 3552.084587][T31502] binder: 31495:31502 ioctl 10 20000280 returned -22
04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x4008630a}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630e}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046315}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)

[ 3552.256786][T31514] binder: 31513:31514 ioctl 541b 20000280 returned -22
[ 3552.413391][T31538] binder: 31535:31538 ioctl 8933 20000280 returned -22
04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11d}, 0x0)

04:21:55 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10) (async)

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086310}], 0x0, 0x0, 0x0})

04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086303}], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630f}], 0x0, 0x0, 0x0})

[ 3552.543427][T31553] binder: 31543:31553 ioctl 400448c9 20000280 returned -22
[ 3552.609272][T31557] binder: 31556:31557 ioctl 8933 20000280 returned -22
04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11e}, 0x0)

04:21:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630e}], 0x0, 0x0, 0x0})

04:21:55 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x3}, 0x1}}, 0x18)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3552.682244][T31562] binder: 31561:31562 ioctl 400448dd 20000280 returned -22
[ 3552.714254][T31566] binder: 31563:31566 ioctl 400448c9 20000280 returned -22
04:21:55 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x4008630a}], 0x0, 0x0, 0x0})

04:21:55 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106308}], 0x0, 0x0, 0x0})

04:21:55 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:21:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x11f}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630f}], 0x0, 0x0, 0x0})

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106309}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x3}, 0x1}}, 0x18) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3552.842879][T31577] binder: 31572:31577 ioctl 400454ca 20000280 returned -22
[ 3552.851829][T31576] binder: 31569:31576 ioctl 400448dd 20000280 returned -22
04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x120}, 0x0)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40086310}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}], 0x0, 0x0, 0x0})

[ 3552.981213][T31589] binder: 31585:31589 ioctl 8933 20000280 returned -22
[ 3552.994141][T31591] binder: 31590:31591 ioctl 400454ca 20000280 returned -22
04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406300}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x121}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106308}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x3}, 0x1}}, 0x18)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
pipe2$watch_queue(&(0x7f0000000000), 0x80) (async)
write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x3}, 0x1}}, 0x18) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630e}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer={0x400c630e}], 0x0, 0x0, 0x0})

[ 3553.139158][T31604] binder: 31597:31604 ioctl 400448c9 20000280 returned -22
[ 3553.266954][T31621] binder: 31614:31621 ioctl 400448dd 20000280 returned -22
04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x122}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106309}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406301}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x400c630f}], 0x0, 0x0, 0x0})

[ 3553.377473][T31631] binder: 31629:31631 ioctl 400454ca 20000280 returned -22
[ 3553.587911][T31649] binder: 31648:31649 ioctl 40086602 20000280 returned -22
04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x123}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406300}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
r1 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001) (async)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async, rerun: 64)
r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106308}], 0x0, 0x0, 0x0})

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486311}], 0x0, 0x0, 0x0})

[ 3553.696975][T31663] binder: 31660:31663 ioctl 400c620e 20000280 returned -22
04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406301}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x124}, 0x0)

[ 3553.734002][T31669] binder: 31665:31669 ioctl 40086602 20000280 returned -22
[ 3553.836630][T31676] binder: 31675:31676 ioctl 400c620e 20000280 returned -22
04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40106309}], 0x0, 0x0, 0x0})

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486312}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x125}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486311}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

[ 3553.953841][T31688] binder: 31682:31688 ioctl 40186366 20000280 returned -22
[ 3554.055543][T31698] binder: 31690:31698 ioctl 40186366 20000280 returned -22
04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

[ 3554.077401][T31699] binder: 31694:31699 ioctl 401c5820 20000280 returned -22
[ 3554.150270][T31704] binder: 31702:31704 ioctl 401c5820 20000280 returned -22
04:21:56 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async, rerun: 32)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406300}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x126}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486312}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x124}, 0x0)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40406301}], 0x0, 0x0, 0x0})

[ 3554.202521][T31710] binder: 31706:31710 ioctl 40086602 20000280 returned -22
04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x127}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3}], 0x0, 0x0, 0x0})

[ 3554.280087][T31719] binder: 31714:31719 ioctl 80086301 20000280 returned -22
[ 3554.310101][T31725] binder: 31718:31725 ioctl 400c620e 20000280 returned -22
04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486311}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$pptp(0x18, 0x1, 0x2)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x128}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2}], 0x0, 0x0, 0x0})

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

[ 3554.388473][T31729] binder: 31727:31729 ioctl 80086301 20000280 returned -22
[ 3554.430494][T31730] binder: 31728:31730 ioctl 80086601 20000280 returned -22
04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40486312}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x129}, 0x0)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$pptp(0x18, 0x1, 0x2)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$pptp(0x18, 0x1, 0x2) (async)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x48, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x87}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x48}}, 0x4000000)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12a}, 0x0)

[ 3554.528823][T31744] binder: 31742:31744 ioctl 80086601 20000280 returned -22
[ 3554.548836][T31745] binder: 31743:31745 ioctl 801c581f 20000280 returned -22
[ 3554.563847][T31748] binder: 31746:31748 ioctl 40186366 20000280 returned -22
04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2}], 0x0, 0x0, 0x0})

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12b}, 0x0)

04:21:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$pptp(0x18, 0x1, 0x2)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

[ 3554.607949][T31751] binder: 31750:31751 ioctl 40046205 0 returned -22
[ 3554.648766][T31755] binder: 31753:31755 ioctl 801c581f 20000280 returned -22
04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5}], 0x0, 0x0, 0x0})

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12c}, 0x0)

04:21:56 executing program 5:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, r0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x96}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_0\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0xc040}, 0x24000081)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6}], 0x0, 0x0, 0x0})

[ 3554.680079][T31758] binder: 31756:31758 ioctl 401c5820 20000280 returned -22
[ 3554.707821][T31762] binder: 31759:31762 ioctl 40046205 0 returned -22
04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x300}], 0x0, 0x0, 0x0})

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12d}, 0x0)

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4}], 0x0, 0x0, 0x0})

04:21:56 executing program 5:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, r0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x96}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_0\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0xc040}, 0x24000081)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:56 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)

04:21:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12e}, 0x0)

04:21:56 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x500}], 0x0, 0x0, 0x0})

04:21:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7}], 0x0, 0x0, 0x0})

04:21:56 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5}], 0x0, 0x0, 0x0})

[ 3554.813537][T31775] binder: 31772:31775 ioctl 40046205 0 returned -22
[ 3554.922183][T31788] binder: 31786:31788 ioctl 80086301 20000280 returned -22
04:21:57 executing program 5:
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, r0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x96}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_0\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0xc040}, 0x24000081)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x48, r0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x96}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'team_slave_0\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_CSUM={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0xc040}, 0x24000081) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x600}], 0x0, 0x0, 0x0})

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x300}], 0x0, 0x0, 0x0})

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x12f}, 0x0)

[ 3555.034530][T31800] binder: 31798:31800 ioctl c00c620f 20000280 returned -22
[ 3555.050014][T31802] binder: 31797:31802 ioctl 80086601 20000280 returned -22
[ 3555.147953][T31810] binder: 31805:31810 ioctl c00c620f 20000280 returned -22
04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x20004001)

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x700}], 0x0, 0x0, 0x0})

04:21:57 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x130}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x500}], 0x0, 0x0, 0x0})

[ 3555.160955][T31809] binder: 31807:31809 ioctl 801c581f 20000280 returned -22
[ 3555.163112][T31812] BUG: sleeping function called from invalid context at lib/usercopy.c:28
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff00}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x300}], 0x0, 0x0, 0x0})

[ 3555.163129][T31812] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 31812, name: syz-executor.1
04:21:57 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0}) (async)
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x131}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x600}], 0x0, 0x0, 0x0})

[ 3555.163150][T31812] preempt_count: 1, expected: 0
[ 3555.163161][T31812] RCU nest depth: 0, expected: 0
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)

04:21:57 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13) (async)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8}) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x132}, 0x0)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x500}], 0x0, 0x0, 0x0})

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x700}], 0x0, 0x0, 0x0})

[ 3555.163172][T31812] 1 lock held by syz-executor.1/31812:
[ 3555.163187][T31812]  #0: ffff88807da00af8 (&proc->inner_lock){+.+.}-{2:2}, at: binder_ioctl+0x798/0x6d80
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2000000}], 0x0, 0x0, 0x0})

[ 3555.163263][T31812] Preemption disabled at:
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x600}], 0x0, 0x0, 0x0})

04:21:57 executing program 5:
r0 = socket(0x22, 0x0, 0x5)
setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x10000, 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x9, 0x1], 0x7762}, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)
socket$nl_generic(0x10, 0x3, 0x10)

[ 3555.163269][T31812] [<0000000000000000>] 0x0
04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x133}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff00}], 0x0, 0x0, 0x0})

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 5:
r0 = socket(0x22, 0x0, 0x5)
setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x10000, 0x4) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x9, 0x1], 0x7762}, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000000c0)=""/18)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x700}], 0x0, 0x0, 0x0})

[ 3555.163290][T31812] CPU: 1 PID: 31812 Comm: syz-executor.1 Not tainted 5.18.0-rc7-next-20220520-syzkaller #0
[ 3555.163320][T31812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x134}, 0x0)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff00}], 0x0, 0x0, 0x0})

04:21:57 executing program 5:
r0 = socket(0x22, 0x0, 0x5)
setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x10000, 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x9, 0x1], 0x7762}, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5000000}], 0x0, 0x0, 0x0})

[ 3555.163336][T31812] Call Trace:
[ 3555.163342][T31812]  <TASK>
[ 3555.163351][T31812]  dump_stack_lvl+0xcd/0x134
[ 3555.163383][T31812]  __might_resched.cold+0x222/0x26b
04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x135}, 0x0)

04:21:57 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7ff, 0x20000)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44804}, 0x20000010)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x1000000}], 0x0, 0x0, 0x0})

[ 3555.163469][T31812]  __might_fault+0x6c/0x170
[ 3555.163503][T31812]  _copy_to_user+0x25/0x140
[ 3555.163532][T31812]  binder_ioctl+0x7aa/0x6d80
04:21:57 executing program 3:
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x136}, 0x0)

04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x2000000}], 0x0, 0x0, 0x0})

[ 3555.163574][T31812]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3555.163616][T31812]  ? tomoyo_path_number_perm+0x24e/0x590
04:21:57 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7ff, 0x20000)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44804}, 0x20000010)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
syz_open_dev$vcsa(&(0x7f0000000000), 0x7ff, 0x20000) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44804}, 0x20000010) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)

04:21:57 executing program 3:
syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x137}, 0x0)

[ 3555.163663][T31812]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3555.163702][T31812]  ? lockdep_hardirqs_on_prepare+0x400/0x400
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x3000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfdfdffff}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x138}, 0x0)

[ 3555.163751][T31812]  ? binder_thread_write+0x3220/0x3220
[ 3555.163786][T31812]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
[ 3555.163825][T31812]  ? do_vfs_ioctl+0x132/0x15c0
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff)

04:21:57 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x7ff, 0x20000) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44804}, 0x20000010) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x139}, 0x0)

[ 3555.163863][T31812]  ? vfs_fileattr_set+0xbe0/0xbe0
[ 3555.163916][T31812]  ? __context_tracking_exit+0xb8/0xe0
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x4000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)

04:21:57 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000128bd7000ffdbdf25030000ff7f000000030000000800110000000000bb9d5b54ab387fae050012000100000006000100070000000500040003000000000e00060001001400080065727370616e300000000000000000000a000c000300000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000)

[ 3555.163965][T31812]  ? __fget_files+0x286/0x470
[ 3555.164007][T31812]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfffffdfd}], 0x0, 0x0, 0x0})

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13a}, 0x0)

[ 3555.164040][T31812]  ? binder_thread_write+0x3220/0x3220
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x5000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfdfdffff}], 0x0, 0x0, 0x0})

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2, 0x0, 0x0})

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13b}, 0x0)

[ 3555.164078][T31812]  __x64_sys_ioctl+0x193/0x200
[ 3555.164114][T31812]  do_syscall_64+0x35/0xb0
[ 3555.164144][T31812]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x6000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async, rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async, rerun: 64)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000128bd7000ffdbdf25030000ff7f000000030000000800110000000000bb9d5b54ab387fae050012000100000006000100070000000500040003000000000e00060001001400080065727370616e300000000000000000000a000c000300000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000)

04:21:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13c}, 0x0)

04:21:57 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:57 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff000000}], 0x0, 0x0, 0x0})

04:21:57 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3, 0x0, 0x0})

[ 3555.164171][T31812] RIP: 0033:0x7fe31e4890e9
[ 3555.164192][T31812] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
04:21:57 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0x7000000}], 0x0, 0x0, 0x0})

04:21:58 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r1=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r1, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=0x0, @ANYBLOB="000004fe5f310451a07466d0f53e"], 0x14}}, 0x0)

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13d}, 0x0)

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfffffdfd}], 0x0, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4, 0x0, 0x0})

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfdfdffff}], 0x0, 0x0, 0x0})

04:21:58 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r0=>0x0})
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x1000, 0x6, '9P2000'}, 0x13)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

[ 3555.164218][T31812] RSP: 002b:00007fe31f546168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3555.164243][T31812] RAX: ffffffffffffffda RBX: 00007fe31e59bf60 RCX: 00007fe31e4890e9
04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r1)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000128bd7000ffdbdf25030000ff7f000000030000000800110000000000bb9d5b54ab387fae050012000100000006000100070000000500040003000000000e00060001001400080065727370616e300000000000000000000a000c000300000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r1) (async)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000128bd7000ffdbdf25030000ff7f000000030000000800110000000000bb9d5b54ab387fae050012000100000006000100070000000500040003000000000e00060001001400080065727370616e300000000000000000000a000c000300000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000) (async)

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2, 0x0, 0x0})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13e}, 0x0)

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff000000}], 0x0, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5, 0x0, 0x0})

[ 3555.164261][T31812] RDX: 0000000020000280 RSI: 00000000c00c6211 RDI: 0000000000000003
04:21:58 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
clock_gettime(0x0, &(0x7f0000000980)={<r0=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={r0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3, 0x0, 0x0})

04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RSYMLINK(r1, &(0x7f0000000040)={0x14, 0x11, 0x1, {0x20, 0x0, 0x1}}, 0x14)

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfffffdfd}], 0x0, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6, 0x0, 0x0})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x13f}, 0x0)

[ 3555.164279][T31812] RBP: 00007fe31e4e308d R08: 0000000000000000 R09: 0000000000000000
[ 3555.164297][T31812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x140}, 0x0)

04:21:58 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4, 0x0, 0x0})

04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RSYMLINK(r1, &(0x7f0000000040)={0x14, 0x11, 0x1, {0x20, 0x0, 0x1}}, 0x14)

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2, 0x0, 0x0})

[ 3555.164313][T31812] R13: 00007ffff03f464f R14: 00007fe31f546300 R15: 0000000000022000
[ 3555.164350][T31812]  </TASK>
[ 3555.164393][T31812] 
04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7, 0x0, 0x0})

04:21:58 executing program 3:
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5, 0x0, 0x0})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x141}, 0x0)

[ 3555.164399][T31812] =============================
[ 3555.164405][T31812] [ BUG: Invalid wait context ]
04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3, 0x0, 0x0})

04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80)
write$P9_RSYMLINK(r1, &(0x7f0000000040)={0x14, 0x11, 0x1, {0x20, 0x0, 0x1}}, 0x14)

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300, 0x0, 0x0})

04:21:58 executing program 3:
pselect6(0x0, 0x0, &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x142}, 0x0)

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500, 0x0, 0x0})

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6, 0x0, 0x0})

[ 3555.164413][T31812] 5.18.0-rc7-next-20220520-syzkaller #0 Tainted: G        W        
[ 3555.164429][T31812] -----------------------------
04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$pptp(0x18, 0x1, 0x2)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x548}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x4)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000140), &(0x7f0000000180)=0x4)
ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000280)=""/143)

04:21:58 executing program 3:
pselect6(0x0, 0x0, 0x0, &(0x7f0000000940)={0x101}, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x143}, 0x0)

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600, 0x0, 0x0})

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7, 0x0, 0x0})

[ 3555.164435][T31812] syz-executor.1/31812 is trying to lock:
[ 3555.164448][T31812] ffff8880777f0828 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0xa1/0x170
04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5, 0x0, 0x0})

04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64)
socket$pptp(0x18, 0x1, 0x2) (rerun: 64)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x548}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x4) (async, rerun: 64)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async, rerun: 64)
ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000280)=""/143)

04:21:58 executing program 3:
pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x144}, 0x0)

[ 3555.164511][T31812] other info that might help us debug this:
[ 3555.164518][T31812] context-{4:4}
[ 3555.164528][T31812] 1 lock held by syz-executor.1/31812:
04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700, 0x0, 0x0})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x145}, 0x0)

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300, 0x0, 0x0})

[ 3555.164543][T31812]  #0: ffff88807da00af8 (&proc->inner_lock){+.+.}-{2:2}, at: binder_ioctl+0x798/0x6d80
04:21:58 executing program 3:
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7, 0x0, 0x0})

[ 3555.164616][T31812] stack backtrace:
[ 3555.164623][T31812] CPU: 1 PID: 31812 Comm: syz-executor.1 Tainted: G        W         5.18.0-rc7-next-20220520-syzkaller #0
04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x146}, 0x0)

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500, 0x0, 0x0})

[ 3555.164653][T31812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
04:21:58 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$pptp(0x18, 0x1, 0x2)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x548}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x4)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000140), &(0x7f0000000180)=0x4)
ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000280)=""/143)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$pptp(0x18, 0x1, 0x2) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x548}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x4) (async)
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async)
ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000280)=""/143) (async)

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:21:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x147}, 0x0)

04:21:58 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600, 0x0, 0x0})

04:21:58 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500, 0x0, 0x0})

04:21:58 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2000000, 0x0, 0x0})

[ 3555.164667][T31812] Call Trace:
[ 3555.164675][T31812]  <TASK>
[ 3555.164683][T31812]  dump_stack_lvl+0xcd/0x134
[ 3555.164712][T31812]  __lock_acquire.cold+0xdb/0x3b4
[ 3555.164770][T31812]  ? lock_chain_count+0x20/0x20
[ 3555.164811][T31812]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3555.164858][T31812]  lock_acquire+0x1ab/0x570
[ 3555.164896][T31812]  ? __might_fault+0xa1/0x170
[ 3555.164926][T31812]  ? lock_release+0x780/0x780
[ 3555.164964][T31812]  ? dump_stack_lvl+0x120/0x134
[ 3555.164992][T31812]  ? dump_stack_lvl+0x12a/0x134
[ 3555.165019][T31812]  ? dump_stack_lvl+0x12c/0x134
[ 3555.165050][T31812]  __might_fault+0x104/0x170
[ 3555.165079][T31812]  ? __might_fault+0xa1/0x170
[ 3555.165108][T31812]  _copy_to_user+0x25/0x140
[ 3555.165132][T31812]  binder_ioctl+0x7aa/0x6d80
[ 3555.165169][T31812]  ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 3555.165202][T31812]  ? tomoyo_path_number_perm+0x24e/0x590
[ 3555.165246][T31812]  ? tomoyo_execute_permission+0x4a0/0x4a0
[ 3555.165284][T31812]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 3555.165335][T31812]  ? binder_thread_write+0x3220/0x3220
[ 3555.165374][T31812]  ? __sanitizer_cov_trace_const_cmp2+0x22/0x80
[ 3555.165408][T31812]  ? do_vfs_ioctl+0x132/0x15c0
[ 3555.165436][T31812]  ? vfs_fileattr_set+0xbe0/0xbe0
[ 3555.165467][T31812]  ? __context_tracking_exit+0xb8/0xe0
[ 3555.165509][T31812]  ? __fget_files+0x286/0x470
[ 3555.165545][T31812]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 3555.165575][T31812]  ? binder_thread_write+0x3220/0x3220
[ 3555.165620][T31812]  __x64_sys_ioctl+0x193/0x200
[ 3555.165656][T31812]  do_syscall_64+0x35/0xb0
[ 3555.165685][T31812]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 3555.165713][T31812] RIP: 0033:0x7fe31e4890e9
[ 3555.165731][T31812] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 3555.165756][T31812] RSP: 002b:00007fe31f546168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 3555.165781][T31812] RAX: ffffffffffffffda RBX: 00007fe31e59bf60 RCX: 00007fe31e4890e9
[ 3555.165800][T31812] RDX: 0000000020000280 RSI: 00000000c00c6211 RDI: 0000000000000003
[ 3555.165817][T31812] RBP: 00007fe31e4e308d R08: 0000000000000000 R09: 0000000000000000
[ 3555.165834][T31812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 3555.165850][T31812] R13: 00007ffff03f464f R14: 00007fe31f546300 R15: 0000000000022000
[ 3555.165876][T31812]  </TASK>
[ 3555.331595][T31839] binder: 31837:31839 ioctl c018620c 20000280 returned -22
[ 3555.363931][T31846] binder: 31845:31846 ioctl c018620c 20000280 returned -22
[ 3555.487598][T31867] binder: 31866:31867 ioctl c00c620f 20000280 returned -22
[ 3555.532879][T31876] binder: 31873:31876 ioctl c0306202 20000280 returned -22
[ 3555.593901][T31888] binder: 31887:31888 ioctl c0306202 20000280 returned -22
[ 3555.600727][T31889] binder: 31886:31889 ioctl c0306203 20000280 returned -22
[ 3555.670834][T31898] binder: 31894:31898 ioctl c0306205 20000280 returned -22
[ 3555.689924][T31904] binder: 31893:31904 ioctl c0306203 20000280 returned -22
[ 3555.719186][T31909] binder: 31908:31909 ioctl c018620c 20000280 returned -22
[ 3555.738217][T31912] binder: 31906:31912 ioctl c0306215 20000280 returned -22
[ 3555.754643][T31916] binder: 31914:31916 ioctl c0306205 20000280 returned -22
[ 3555.810601][T31923] binder: 31921:31923 unknown command 0
[ 3555.810622][T31923] binder: 31921:31923 ioctl c0306201 20000280 returned -22
[ 3555.814481][T31927] binder: 31922:31927 ioctl c0306215 20000280 returned -22
[ 3555.867868][T31935] binder: 31933:31935 unknown command 16392
[ 3555.867891][T31935] binder: 31933:31935 ioctl c0306201 20000280 returned -22
[ 3555.899061][T31942] binder: 31936:31942 ioctl c0046209 0 returned -22
[ 3555.900942][T31945] binder: 31939:31945 unknown command 0
[ 3555.900963][T31945] binder: 31939:31945 ioctl c0306201 20000280 returned -22
[ 3555.924480][T31947] binder: 31938:31947 ioctl c0306202 20000280 returned -22
[ 3555.947037][T31950] binder: 31948:31950 unknown command 64
[ 3555.947060][T31950] binder: 31948:31950 ioctl c0306201 20000280 returned -22
[ 3555.970941][T31957] binder: 31953:31957 ioctl c0046209 0 returned -22
[ 3555.977268][T31956] binder: 31949:31956 unknown command 16392
[ 3555.977293][T31956] binder: 31949:31956 ioctl c0306201 20000280 returned -22
[ 3555.990543][T31959] binder: 31955:31959 ioctl c0306203 20000280 returned -22
[ 3556.007941][T31963] binder: 31960:31963 unknown command 0
[ 3556.007962][T31963] binder: 31960:31963 ioctl c0306201 20000280 returned -22
[ 3556.044635][T31974] binder: 31964:31974 unknown command 64
[ 3556.044657][T31974] binder: 31964:31974 ioctl c0306201 20000280 returned -22
[ 3556.048613][T31968] binder: 31961:31968 ioctl c0046209 0 returned -22
[ 3556.068570][T31979] binder: 31966:31979 ioctl c0306205 20000280 returned -22
[ 3556.081536][T31980] binder: 31975:31980 unknown command 0
[ 3556.081555][T31980] binder: 31975:31980 ioctl c0306201 20000280 returned -22
[ 3556.134689][T31987] binder: 31985:31987 unknown command 0
[ 3556.134711][T31987] binder: 31985:31987 ioctl c0306201 20000280 returned -22
[ 3556.141705][T31994] binder: 31989:31994 ioctl c0306215 20000280 returned -22
[ 3556.161432][T31995] binder: 31993:31995 unknown command 0
[ 3556.161453][T31995] binder: 31993:31995 ioctl c0306201 20000280 returned -22
[ 3556.171257][T31998] binder: 31996:31998 ioctl c0046209 0 returned -22
[ 3556.215474][T32004] binder: 32002:32004 unknown command 0
[ 3556.215496][T32004] binder: 32002:32004 ioctl c0306201 20000280 returned -22
[ 3556.221675][T32008] binder: 32005:32008 unknown command 0
[ 3556.221695][T32008] binder: 32005:32008 ioctl c0306201 20000280 returned -22
[ 3556.246943][T32009] binder: 32003:32009 unknown command 0
[ 3556.246963][T32009] binder: 32003:32009 ioctl c0306201 20000280 returned -22
[ 3556.254720][T32017] binder: 32007:32017 ioctl c0046209 0 returned -22
[ 3556.271423][T32020] binder: 32018:32020 unknown command 16392
[ 3556.271442][T32020] binder: 32018:32020 ioctl c0306201 20000280 returned -22
[ 3556.294633][T32019] binder: 32011:32019 unknown command 0
04:21:59 executing program 3:
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:21:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x148}, 0x0)

04:21:59 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00032cbd7000fedbdf25050001000000000000000000000000000800180000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000050}, 0x1)
r2 = socket(0x26, 0x800, 0x4)
setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:59 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600, 0x0, 0x0})

04:21:59 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3000000, 0x0, 0x0})

04:21:59 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700, 0x0, 0x0})

04:21:59 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:21:59 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700, 0x0, 0x0})

[ 3556.294655][T32019] binder: 32011:32019 ioctl c0306201 20000280 returned -22
[ 3556.310011][T32026] binder: 32025:32026 ioctl c0046209 0 returned -22
[ 3556.336011][T32030] binder: 32027:32030 unknown command 64
[ 3556.336032][T32030] binder: 32027:32030 ioctl c0306201 20000280 returned -22
[ 3556.352696][T32034] binder: 32033:32034 unknown command 0
[ 3556.352714][T32034] binder: 32033:32034 ioctl c0306201 20000280 returned -22
04:21:59 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00032cbd7000fedbdf25050001000000000000000000000000000800180000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000050}, 0x1) (async)
r2 = socket(0x26, 0x800, 0x4)
setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:21:59 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4000000, 0x0, 0x0})

04:21:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x149}, 0x0)

04:21:59 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5000000, 0x0, 0x0})

[ 3556.417093][T32043] binder: 32042:32043 unknown command 0
[ 3556.417115][T32043] binder: 32042:32043 ioctl c0306201 20000280 returned -22
[ 3556.467175][T32054] binder: 32051:32054 unknown command 0
[ 3556.467197][T32054] binder: 32051:32054 ioctl c0306201 20000280 returned -22
[ 3556.543543][T32068] binder: 32065:32068 unknown command 0
[ 3556.543566][T32068] binder: 32065:32068 ioctl c0306201 20000280 returned -22
[ 3556.612435][T32080] binder: 32076:32080 unknown command 0
[ 3556.612457][T32080] binder: 32076:32080 ioctl c0306201 20000280 returned -22
[ 3557.313240][T32211] loop5: detected capacity change from 0 to 236
[ 3557.390692][T32225] loop5: detected capacity change from 0 to 236
[ 3557.439464][T32233] binder: 32229:32233 ioctl c0306201 0 returned -14
[ 3557.469884][T32238] loop5: detected capacity change from 0 to 236
[ 3557.513773][T32248] binder: 32244:32248 ioctl c0306201 0 returned -14
[ 3557.557819][T32257] binder: 32256:32257 ioctl c0306201 0 returned -14
[ 3558.063058][T32347] binder: 32345:32347 unknown command 0
[ 3558.063081][T32347] binder: 32345:32347 ioctl c0306201 20000280 returned -22
[ 3558.123221][T32359] binder: 32355:32359 unknown command 0
[ 3558.123244][T32359] binder: 32355:32359 ioctl c0306201 20000280 returned -22
[ 3558.140670][T32353] loop3: detected capacity change from 0 to 236
[ 3558.180525][T32366] binder: 32365:32366 unknown command 0
[ 3558.180546][T32366] binder: 32365:32366 ioctl c0306201 20000280 returned -22
[ 3558.200908][T32370] binder: 32368:32370 unknown command 0
[ 3558.200930][T32370] binder: 32368:32370 ioctl c0306201 20000280 returned -22
[ 3558.226068][T32373] loop3: detected capacity change from 0 to 236
[ 3558.245218][T32378] binder: 32376:32378 unknown command 0
[ 3558.245239][T32378] binder: 32376:32378 ioctl c0306201 20000280 returned -22
[ 3558.282229][T32383] binder: BC_ACQUIRE_RESULT not supported
[ 3558.282242][T32383] binder: 32380:32383 ioctl c0306201 20000280 returned -22
[ 3558.310226][T32388] loop3: detected capacity change from 0 to 236
[ 3558.315453][T32390] binder: 32389:32390 unknown command 0
[ 3558.315475][T32390] binder: 32389:32390 ioctl c0306201 20000280 returned -22
[ 3558.327906][T32394] binder: 32392:32394 unknown command 0
[ 3558.327928][T32394] binder: 32392:32394 ioctl c0306201 20000280 returned -22
[ 3558.355849][T32399] binder: 32398:32399 unknown command 0
[ 3558.361465][T32399] binder: 32398:32399 ioctl c0306201 20000280 returned -22
[ 3558.389741][T32404] binder: BC_ACQUIRE_RESULT not supported
[ 3558.389754][T32404] binder: 32400:32404 ioctl c0306201 20000280 returned -22
[ 3558.394641][T32405] binder: 32402:32405 unknown command 0
[ 3558.394659][T32405] binder: 32402:32405 ioctl c0306201 20000280 returned -22
[ 3558.429772][T32411] binder: 32410:32411 unknown command 0
[ 3558.429794][T32411] binder: 32410:32411 ioctl c0306201 20000280 returned -22
[ 3558.439771][T32413] loop3: detected capacity change from 0 to 236
[ 3558.446949][T32414] binder: 32408:32414 unknown command 0
[ 3558.446969][T32414] binder: 32408:32414 ioctl c0306201 20000280 returned -22
[ 3558.477465][T32415] binder: 32409:32415 unknown command 1074291458
[ 3558.477488][T32415] binder: 32409:32415 ioctl c0306201 20000280 returned -22
[ 3558.492649][T32420] binder: 32419:32420 unknown command 0
[ 3558.492670][T32420] binder: 32419:32420 ioctl c0306201 20000280 returned -22
[ 3558.526011][T32424] binder: 32422:32424 unknown command 0
[ 3558.526034][T32424] binder: 32422:32424 ioctl c0306201 20000280 returned -22
[ 3558.542985][T32426] binder: 32425:32426 unknown command 1074291463
[ 3558.543006][T32426] binder: 32425:32426 ioctl c0306201 20000280 returned -22
[ 3558.563888][T32431] binder: BC_ACQUIRE_RESULT not supported
[ 3558.563901][T32431] binder: 32428:32431 ioctl c0306201 20000280 returned -22
[ 3558.575945][T32434] binder: 32432:32434 unknown command 1074291458
[ 3558.575967][T32434] binder: 32432:32434 ioctl c0306201 20000280 returned -22
[ 3558.621672][T32437] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3558.621685][T32437] binder: 32433:32437 ioctl c0306201 20000280 returned -22
[ 3558.631481][T27878] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
[ 3558.632071][T32438] binder: 32436:32438 unknown command 0
[ 3558.632092][T32438] binder: 32436:32438 ioctl c0306201 20000280 returned -22
[ 3558.637854][T32441] loop3: detected capacity change from 0 to 236
[ 3558.654937][T32445] binder: 32444:32445 unknown command 1074291463
[ 3558.654961][T32445] binder: 32444:32445 ioctl c0306201 20000280 returned -22
[ 3558.717092][T32454] binder: 32450:32454 unknown command 0
[ 3558.717115][T32454] binder: 32450:32454 ioctl c0306201 20000280 returned -22
[ 3558.724716][T32455] binder: 32453:32455 unknown command 1074291474
[ 3558.724740][T32455] binder: 32453:32455 ioctl c0306201 20000280 returned -22
[ 3558.735132][T32458] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3558.735146][T32458] binder: 32452:32458 ioctl c0306201 20000280 returned -22
[ 3558.791403][T32465] binder: 32463:32465 unknown command 1074291477
[ 3558.791427][T32465] binder: 32463:32465 ioctl c0306201 20000280 returned -22
[ 3558.792546][T32464] binder: 32462:32464 unknown command 1074291458
[ 3558.792564][T32464] binder: 32462:32464 ioctl c0306201 20000280 returned -22
[ 3558.855512][T32480] binder: 32475:32480 unknown command 1074291463
[ 3558.855534][T32480] binder: 32475:32480 ioctl c0306201 20000280 returned -22
[ 3558.866276][T32482] binder: 32479:32482 unknown command 1074291474
[ 3558.866298][T32482] binder: 32479:32482 ioctl c0306201 20000280 returned -22
[ 3558.868772][T32478] binder: 32477:32478 unknown command 0
04:22:00 executing program 3:
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})

04:22:00 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) (async)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00032cbd7000fedbdf25050001000000000000000000000000000800180000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000050}, 0x1) (async)
r2 = socket(0x26, 0x800, 0x4)
setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)

04:22:00 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:22:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14a}, 0x0)

04:22:00 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:00 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6000000, 0x0, 0x0})

04:22:00 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2000000, 0x0, 0x0})

[ 3558.868791][T32478] binder: 32477:32478 ioctl c0306201 20000280 returned -22
[ 3558.926015][T32490] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3558.926028][T32490] binder: 32486:32490 ioctl c0306201 20000280 returned -22
[ 3558.941775][T32495] binder: 32487:32495 unknown command 1074291477
[ 3558.941797][T32495] binder: 32487:32495 ioctl c0306201 20000280 returned -22
[ 3558.942365][T32493] binder: 32492:32493 unknown command 0
04:22:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14b}, 0x0)

04:22:00 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000200", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x5f}}, 0x0)

04:22:00 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7000000, 0x0, 0x0})

[ 3558.942383][T32493] binder: 32492:32493 ioctl c0306201 20000280 returned -22
[ 3559.002592][T32503] binder: 32502:32503 unknown command 0
[ 3559.002617][T32503] binder: 32502:32503 ioctl c0306201 20000280 returned -22
04:22:00 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff, 0x0, 0x0})

[ 3559.049949][T32515] binder: 32504:32515 unknown command 1074291474
[ 3559.049972][T32515] binder: 32504:32515 ioctl c0306201 20000280 returned -22
[ 3559.105384][T32524] binder: 32523:32524 unknown command 0
[ 3559.105406][T32524] binder: 32523:32524 ioctl c0306201 20000280 returned -22
[ 3559.115893][T32525] binder: 32517:32525 unknown command 0
[ 3559.115913][T32525] binder: 32517:32525 ioctl c0306201 20000280 returned -22
[ 3559.134478][T32532] binder: 32521:32532 unknown command 1074291477
[ 3559.134501][T32532] binder: 32521:32532 ioctl c0306201 20000280 returned -22
[ 3559.184788][T32539] binder: 32534:32539 unknown command 0
[ 3559.184811][T32539] binder: 32534:32539 ioctl c0306201 20000280 returned -22
[ 3559.201741][T32542] binder: 32540:32542 unknown command 0
[ 3559.201772][T32542] binder: 32540:32542 ioctl c0306201 20000280 returned -22
[ 3559.255402][T32550] binder: 32546:32550 unknown command 0
[ 3559.255425][T32550] binder: 32546:32550 ioctl c0306201 20000280 returned -22
[ 3559.268922][T32553] binder: 32548:32553 unknown command 0
[ 3559.268943][T32553] binder: 32548:32553 ioctl c0306201 20000280 returned -22
[ 3559.486720][T32600] binder: 32599:32600 unknown command 0
[ 3559.486743][T32600] binder: 32599:32600 ioctl c0306201 20000280 returned -22
[ 3559.546577][T32610] binder: 32608:32610 unknown command 0
[ 3559.546598][T32610] binder: 32608:32610 ioctl c0306201 20000280 returned -22
[ 3559.578567][T32620] binder: 32618:32620 unknown command 0
[ 3559.578589][T32620] binder: 32618:32620 ioctl c0306201 20000280 returned -22
[ 3559.609333][T32623] binder: 32613:32623 unknown command 0
[ 3559.609355][T32623] binder: 32613:32623 ioctl c0306201 20000280 returned -22
[ 3559.643627][T32627] binder: 32626:32627 unknown command 0
[ 3559.643651][T32627] binder: 32626:32627 ioctl c0306201 20000280 returned -22
[ 3559.736199][T32643] binder: 32636:32643 unknown command 0
[ 3559.736229][T32643] binder: 32636:32643 ioctl c0306201 20000280 returned -22
[ 3559.736819][T32642] binder: BC_ACQUIRE_RESULT not supported
[ 3559.736830][T32642] binder: 32634:32642 ioctl c0306201 20000280 returned -22
[ 3559.763658][T32646] binder: 32645:32646 unknown command 0
[ 3559.763681][T32646] binder: 32645:32646 ioctl c0306201 20000280 returned -22
[ 3559.793385][T32650] binder: BC_ACQUIRE_RESULT not supported
[ 3559.793398][T32650] binder: 32649:32650 ioctl c0306201 20000280 returned -22
[ 3559.844076][T32660] binder: 32658:32660 unknown command 0
[ 3559.844099][T32660] binder: 32658:32660 ioctl c0306201 20000280 returned -22
[ 3559.915907][T32676] binder: 32675:32676 unknown command 1074029330
[ 3559.915929][T32676] binder: 32675:32676 ioctl c0306201 20000280 returned -22
[ 3559.922582][T32677] binder: 32672:32677 unknown command 0
[ 3559.922598][T32677] binder: 32672:32677 ioctl c0306201 20000280 returned -22
[ 3559.980312][T32689] binder: 32687:32689 unknown command 1074029333
[ 3559.980335][T32689] binder: 32687:32689 ioctl c0306201 20000280 returned -22
[ 3559.982352][T32690] binder: BC_ACQUIRE_RESULT not supported
[ 3559.982364][T32690] binder: 32682:32690 ioctl c0306201 20000280 returned -22
[ 3560.004907][T32693] binder: 32692:32693 ioctl c0306201 0 returned -14
[ 3560.015970][T32694] binder: 32691:32694 unknown command 1074029330
[ 3560.015994][T32694] binder: 32691:32694 ioctl c0306201 20000280 returned -22
[ 3560.090966][T32706] binder: 32702:32706 unknown command 1074029333
[ 3560.090989][T32706] binder: 32702:32706 ioctl c0306201 20000280 returned -22
[ 3560.100518][T32707] binder: 32701:32707 ioctl c0306201 0 returned -14
[ 3560.132458][T32713] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3560.132471][T32713] binder: 32708:32713 ioctl c0306201 20000280 returned -22
[ 3560.180441][T32723] binder: 32710:32723 ioctl c0306201 0 returned -14
[ 3560.182336][T32721] binder: 32717:32721 unknown command 1074029330
[ 3560.182357][T32721] binder: 32717:32721 ioctl c0306201 20000280 returned -22
[ 3560.217590][T32729] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3560.217611][T32729] binder: 32726:32729 ioctl c0306201 20000280 returned -22
[ 3560.257262][T32731] binder: 32730:32731 unknown command 1074029333
[ 3560.257285][T32731] binder: 32730:32731 ioctl c0306201 20000280 returned -22
[ 3560.431950][T32762] binder: BC_ATTEMPT_ACQUIRE not supported
[ 3560.431964][T32762] binder: 32756:32762 ioctl c0306201 20000280 returned -22
[ 3562.323024][  T632] binder: 628:632 ioctl c0306201 20000280 returned -14
[ 3562.386364][  T646] binder: 642:646 ioctl c0306201 20000280 returned -14
[ 3562.472263][  T657] binder: 654:657 ioctl c0306201 20000280 returned -14
[ 3562.510459][  T667] binder: 660:667 ioctl c0306201 20000280 returned -14
[ 3562.538629][  T673] binder: 670:673 ioctl c0306201 20000280 returned -14
[ 3562.594911][  T676] binder: 675:676 ioctl c0306201 20000280 returned -14
[ 3562.624546][  T685] binder: 684:685 ioctl c0306201 20000280 returned -14
[ 3562.650306][  T689] binder: 687:689 ioctl c0306201 20000280 returned -14
[ 3562.675521][  T697] binder: 688:697 ioctl c0306201 20000280 returned -14
04:22:01 executing program 3:
pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0}, 0x0)

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x2000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14c}, 0x0)

04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000200", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x5f}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000200", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x5f}}, 0x0) (async)

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff000000, 0x0, 0x0})

04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000200", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x5f}}, 0x0)

[ 3562.696187][  T701] binder: 694:701 ioctl c0306201 20000280 returned -14
[ 3562.723675][  T703] binder: 699:703 ioctl c0306201 20000280 returned -14
[ 3562.734365][  T706] binder: 705:706 ioctl c0306201 20000280 returned -14
[ 3562.740012][  T708] binder: 704:708 ioctl c0306201 20000280 returned -14
04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x3000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14d}, 0x0)

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfffffdfd, 0x0, 0x0})

04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7db1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

[ 3562.807158][  T717] binder: 714:717 ioctl c0306201 20000280 returned -14
04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x4000000, 0x0, 0x0})

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x100000000000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14e}, 0x0)

04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

[ 3562.810271][  T721] binder: 720:721 ioctl c0306201 20000280 returned -14
[ 3562.812437][  T718] binder: 715:718 ioctl c0306201 20000280 returned -14
04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7db1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x200000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x5000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x14f}, 0x0)

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x6000000, 0x0, 0x0})

[ 3562.870114][  T731] binder: 725:731 ioctl c0306201 20000280 returned -14
[ 3562.894911][  T732] binder: 728:732 ioctl c0306201 20000280 returned -14
04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7db1", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)

04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7000000, 0x0, 0x0})

[ 3562.911523][  T738] binder: 736:738 ioctl c0306201 20000280 returned -14
[ 3562.932748][  T743] binder: 740:743 ioctl c0306201 20000280 returned -14
04:22:01 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0xfffffffffffffffd, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r0, 0x302, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x4000)

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x150}, 0x0)

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x7000000, 0x0, 0x0})

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x400000000000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff, 0x0, 0x0})

[ 3562.946406][  T746] binder: 742:746 ioctl c0306201 20000280 returned -14
[ 3562.988880][  T749] binder: 744:749 ioctl c0306201 20000280 returned -14
04:22:01 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x151}, 0x0)

04:22:01 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0xfffffffffffffffd, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r0, 0x302, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x4000)

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff000000, 0x0, 0x0})

[ 3563.002705][  T753] binder: 751:753 ioctl c0306201 20000280 returned -14
[ 3563.015303][  T756] binder: 752:756 ioctl c0306201 20000280 returned -14
04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x152}, 0x0)

04:22:01 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

[ 3563.055431][  T760] binder: 758:760 ioctl c0306201 20000280 returned -14
[ 3563.068343][  T764] binder: 762:764 ioctl c0306201 20000280 returned -14
04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x153}, 0x0)

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfffffdfd, 0x0, 0x0})

04:22:01 executing program 5:
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), 0xffffffffffffffff) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="810829bd7000fbdbdf2501000000140008006272696467655f736c6176655f31000008000b"], 0x30}}, 0x0) (async)
r2 = syz_open_dev$vcsa(&(0x7f00000005c0), 0xfffffffffffffffd, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r2) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r0, 0x302, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x4000)

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff000000, 0x0, 0x0})

[ 3563.071285][  T765] binder: 763:765 ioctl c0306201 20000280 returned -14
04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700000000000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x154}, 0x0)

04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x100000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfffffdfd, 0x0, 0x0})

04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$inet6_udplite(0xa, 0x2, 0x88)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100), &(0x7f0000000140)=0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x40080d0)

[ 3563.119340][  T776] binder: 775:776 ioctl c0306201 20000280 returned -14
[ 3563.124323][  T779] binder: 777:779 ioctl c0306201 20000280 returned -14
[ 3563.125373][  T780] binder: 778:780 ioctl c0306201 20000280 returned -14
04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x155}, 0x0)

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x200000000000000, 0x0, 0x0})

04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff00000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x100000000000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300000000000000, 0x0, 0x0})

04:22:01 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

[ 3563.853426][  T786] binder: 784:786 ioctl c0306201 20000280 returned -14
[ 3563.858247][  T788] binder: 787:788 ioctl c0306201 20000280 returned -14
04:22:01 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$inet6_udplite(0xa, 0x2, 0x88)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100), &(0x7f0000000140)=0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x40080d0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
socket$inet6_udplite(0xa, 0x2, 0x88) (async)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100), &(0x7f0000000140)=0x10) (async)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x40080d0) (async)

04:22:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x156}, 0x0)

04:22:01 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

[ 3563.858995][  T789] binder: 785:789 ioctl c0306201 20000280 returned -14
04:22:01 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00000000000000, 0x0, 0x0})

04:22:01 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x200000000000000, 0x0, 0x0})

04:22:01 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x400000000000000, 0x0, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
r1 = socket$inet6_udplite(0xa, 0x2, 0x88)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100), &(0x7f0000000140)=0x10)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x40080d0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
socket$inet6_udplite(0xa, 0x2, 0x88) (async)
getsockopt$sock_timeval(r1, 0x1, 0x43, &(0x7f0000000100), &(0x7f0000000140)=0x10) (async)
sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x40080d0) (async)

[ 3563.907131][  T798] binder: 796:798 ioctl c0306201 20000280 returned -14
[ 3563.941765][  T802] binder: 797:802 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x157}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500000000000000, 0x0, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x158}, 0x0)

[ 3563.943594][  T803] binder: 793:803 ioctl c0306201 20000280 returned -14
04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x300000000000000, 0x0, 0x0})

04:22:02 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:02 executing program 5:
clock_gettime(0x0, &(0x7f0000000980)={<r0=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x5}, &(0x7f00000009c0)={r0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_getres(0x7, &(0x7f0000000000))
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x54}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600000000000000, 0x0, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x159}, 0x0)

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x400000000000000, 0x0, 0x0})

[ 3563.978511][  T805] binder: 804:805 ioctl c0306201 20000280 returned -14
[ 3564.742681][  T812] binder: 811:812 ioctl c0306201 20000280 returned -14
04:22:02 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x1000000, 0x0, 0x0})

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700000000000000, 0x0, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15a}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x500000000000000, 0x0, 0x0})

[ 3564.745082][  T814] binder: 807:814 ioctl c0306201 20000280 returned -14
[ 3564.751772][  T810] binder: 808:810 ioctl c0306201 20000280 returned -14
[ 3564.810031][  T823] binder: 821:823 ioctl c0306201 20000280 returned -14
04:22:02 executing program 5:
clock_gettime(0x0, &(0x7f0000000980)={<r0=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x5}, &(0x7f00000009c0)={r0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_getres(0x7, &(0x7f0000000000)) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x54}, 0x0)

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15b}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff00000000, 0x0, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5, 0x0})

[ 3564.810961][  T824] binder: 822:824 ioctl c0306201 20000280 returned -14
[ 3564.827459][  T820] binder: 819:820 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15c}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x600000000000000, 0x0, 0x0})

04:22:02 executing program 5:
clock_gettime(0x0, &(0x7f0000000980)={<r0=>0x0})
pselect6(0x40, &(0x7f00000008c0), &(0x7f0000000900)={0x4}, &(0x7f0000000940)={0x101, 0x0, 0x5}, &(0x7f00000009c0)={r0, 0x0}, &(0x7f0000000a40)={&(0x7f0000000a00)={[0xdcf2]}, 0x8})
clock_getres(0x7, &(0x7f0000000000)) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x54}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00000000000000, 0x0, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15d}, 0x0)

[ 3564.860890][  T830] binder: 829:830 ioctl c0306201 20000280 returned -14
[ 3565.631787][  T835] binder: 833:835 ioctl c0306201 20000280 returned -14
[ 3565.639476][  T839] binder: 832:839 ioctl c0306201 20000280 returned -14
04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x700000000000000, 0x0, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15e}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000d20f89a917a997e249c04098ebcc759fc2f3d24b52a8c4d8e0963aadfe017a79f139b3c741ef1d639cad4756a0b07122582ffedeb198917b1b7472bb4e75b4058230feaa670dbca2fbd42fcfd0baf3e56d5346cc1b7122638f29b5fd7d09805cc7a5b62c4bfc44e2c0ff503efc92686df77154de9daae24848f599a3c1ff74740a9aa1deaa3c4d9d58eee71676a6b800a708a64f498efd2e82aa0cdfac32b0f91858ff"], 0x14}}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xfdfdffff00000000, 0x0, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000d20f89a917a997e249c04098ebcc759fc2f3d24b52a8c4d8e0963aadfe017a79f139b3c741ef1d639cad4756a0b07122582ffedeb198917b1b7472bb4e75b4058230feaa670dbca2fbd42fcfd0baf3e56d5346cc1b7122638f29b5fd7d09805cc7a5b62c4bfc44e2c0ff503efc92686df77154de9daae24848f599a3c1ff74740a9aa1deaa3c4d9d58eee71676a6b800a708a64f498efd2e82aa0cdfac32b0f91858ff"], 0x14}}, 0x0)

[ 3565.649040][  T841] binder: 831:841 ioctl c0306201 20000280 returned -14
[ 3565.721025][  T848] binder: 847:848 ioctl c0306201 20000280 returned -14
04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x300, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x15f}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00000000000000, 0x0, 0x0})

[ 3565.725710][  T850] binder: 849:850 ioctl c0306201 20000280 returned -14
[ 3565.739856][  T852] binder: 845:852 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x160}, 0x0)

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x500, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000d20f89a917a997e249c04098ebcc759fc2f3d24b52a8c4d8e0963aadfe017a79f139b3c741ef1d639cad4756a0b07122582ffedeb198917b1b7472bb4e75b4058230feaa670dbca2fbd42fcfd0baf3e56d5346cc1b7122638f29b5fd7d09805cc7a5b62c4bfc44e2c0ff503efc92686df77154de9daae24848f599a3c1ff74740a9aa1deaa3c4d9d58eee71676a6b800a708a64f498efd2e82aa0cdfac32b0f91858ff"], 0x14}}, 0x0)

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4, 0x0})

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x161}, 0x0)

[ 3565.761983][  T855] binder: 854:855 ioctl c0306201 20000280 returned -14
[ 3565.790348][  T866] binder: 861:866 ioctl c0306201 20000280 returned -14
04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x600, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r1}, 0x14}}, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="996662adb0f98e592887e029e5d9f0aade03112d9b783c09d812768cecbddbc6234aa073c29f8af08f80a213c86ee295fdf10c6b7f15e4f163f1f2c804c6a8c9cd8eceaae7f9bb8fc8343c01a6040bc9e7d53f1e7d33dccc31239f717eb9f131373acc11e4868576ee0587dc7003b5ee5502bbb354a4725e0fd0daa732e774e154ef9b9c9555c186bd52a2c9e2b964e5979a92f1210343ec0986eb1c21deb07c77f0f41b57c5d80da47500923cc503a1f5ec38e5e8d1b55fae0c9332a407d915debf6c42e25858994d388934", 0xcc}, {&(0x7f0000000140)="d20d46af7682ace831fb9e9d7a584651ee9a514b3f48c69e245158e3d7ae918e017e2307daf2e67a38ad99d948b11441813f9311506124c631e6d5628dc7873611b3990a2f6ab18cc7386d5b9d9f4afefd3e0557ee7a182fd4c5b5db8af2a5638132b5a8b29548a76236a2122015de7d2b355212f24b975b5262334164e436dea26a87cb4e2923cb03d1c0", 0x8b}], 0x2, &(0x7f0000000300)="ca5abcc835739a0e3954cf85a4b960a9b9b33839c9194cb07787e475c0c68b2278358965fa8774fa9bf6ceac9e907942711ef8fd867ee656965a7189c7428cd58caf383f5e6bd2b83ef0ea0a00650e5a9177bd670d58b7040d2eae55e722eb6bc3e2528e7db3015c4471ad23c098b5d505837cec7c0f3db788276a072b6fa2813d57ed7f681306ac61e6ae051efa42fefd7d3997952eff4817dd20e3c051ce1fe56c9e28064f22e87f1df9ac0d4d524bb5202b7be0aea8500bdda88d8d6334d02e855a429639b115bd6b746b1e55b6f74a9e6b4734f2f2bb719a6f04c131d8e9cbad20497b9e8ee10fc1daf7ce7e12cb78d4c0444f14f2f403", 0xf9, 0x4000800}, 0x804)

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2, 0x0})

[ 3565.797372][  T860] binder: 858:860 ioctl c0306201 20000280 returned -14
[ 3565.821091][  T872] binder: 867:872 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x162}, 0x0)

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3, 0x0})

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6, 0x0})

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x700, 0x0})

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r1}, 0x14}}, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="996662adb0f98e592887e029e5d9f0aade03112d9b783c09d812768cecbddbc6234aa073c29f8af08f80a213c86ee295fdf10c6b7f15e4f163f1f2c804c6a8c9cd8eceaae7f9bb8fc8343c01a6040bc9e7d53f1e7d33dccc31239f717eb9f131373acc11e4868576ee0587dc7003b5ee5502bbb354a4725e0fd0daa732e774e154ef9b9c9555c186bd52a2c9e2b964e5979a92f1210343ec0986eb1c21deb07c77f0f41b57c5d80da47500923cc503a1f5ec38e5e8d1b55fae0c9332a407d915debf6c42e25858994d388934", 0xcc}, {&(0x7f0000000140)="d20d46af7682ace831fb9e9d7a584651ee9a514b3f48c69e245158e3d7ae918e017e2307daf2e67a38ad99d948b11441813f9311506124c631e6d5628dc7873611b3990a2f6ab18cc7386d5b9d9f4afefd3e0557ee7a182fd4c5b5db8af2a5638132b5a8b29548a76236a2122015de7d2b355212f24b975b5262334164e436dea26a87cb4e2923cb03d1c0", 0x8b}], 0x2, &(0x7f0000000300)="ca5abcc835739a0e3954cf85a4b960a9b9b33839c9194cb07787e475c0c68b2278358965fa8774fa9bf6ceac9e907942711ef8fd867ee656965a7189c7428cd58caf383f5e6bd2b83ef0ea0a00650e5a9177bd670d58b7040d2eae55e722eb6bc3e2528e7db3015c4471ad23c098b5d505837cec7c0f3db788276a072b6fa2813d57ed7f681306ac61e6ae051efa42fefd7d3997952eff4817dd20e3c051ce1fe56c9e28064f22e87f1df9ac0d4d524bb5202b7be0aea8500bdda88d8d6334d02e855a429639b115bd6b746b1e55b6f74a9e6b4734f2f2bb719a6f04c131d8e9cbad20497b9e8ee10fc1daf7ce7e12cb78d4c0444f14f2f403", 0xf9, 0x4000800}, 0x804)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r1}, 0x14}}, 0x0) (async)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="996662adb0f98e592887e029e5d9f0aade03112d9b783c09d812768cecbddbc6234aa073c29f8af08f80a213c86ee295fdf10c6b7f15e4f163f1f2c804c6a8c9cd8eceaae7f9bb8fc8343c01a6040bc9e7d53f1e7d33dccc31239f717eb9f131373acc11e4868576ee0587dc7003b5ee5502bbb354a4725e0fd0daa732e774e154ef9b9c9555c186bd52a2c9e2b964e5979a92f1210343ec0986eb1c21deb07c77f0f41b57c5d80da47500923cc503a1f5ec38e5e8d1b55fae0c9332a407d915debf6c42e25858994d388934", 0xcc}, {&(0x7f0000000140)="d20d46af7682ace831fb9e9d7a584651ee9a514b3f48c69e245158e3d7ae918e017e2307daf2e67a38ad99d948b11441813f9311506124c631e6d5628dc7873611b3990a2f6ab18cc7386d5b9d9f4afefd3e0557ee7a182fd4c5b5db8af2a5638132b5a8b29548a76236a2122015de7d2b355212f24b975b5262334164e436dea26a87cb4e2923cb03d1c0", 0x8b}], 0x2, &(0x7f0000000300)="ca5abcc835739a0e3954cf85a4b960a9b9b33839c9194cb07787e475c0c68b2278358965fa8774fa9bf6ceac9e907942711ef8fd867ee656965a7189c7428cd58caf383f5e6bd2b83ef0ea0a00650e5a9177bd670d58b7040d2eae55e722eb6bc3e2528e7db3015c4471ad23c098b5d505837cec7c0f3db788276a072b6fa2813d57ed7f681306ac61e6ae051efa42fefd7d3997952eff4817dd20e3c051ce1fe56c9e28064f22e87f1df9ac0d4d524bb5202b7be0aea8500bdda88d8d6334d02e855a429639b115bd6b746b1e55b6f74a9e6b4734f2f2bb719a6f04c131d8e9cbad20497b9e8ee10fc1daf7ce7e12cb78d4c0444f14f2f403", 0xf9, 0x4000800}, 0x804) (async)

[ 3565.847401][  T875] binder: 873:875 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x163}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0x0, 0x0, 0x0})

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x164}, 0x0)

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r1}, 0x14}}, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="996662adb0f98e592887e029e5d9f0aade03112d9b783c09d812768cecbddbc6234aa073c29f8af08f80a213c86ee295fdf10c6b7f15e4f163f1f2c804c6a8c9cd8eceaae7f9bb8fc8343c01a6040bc9e7d53f1e7d33dccc31239f717eb9f131373acc11e4868576ee0587dc7003b5ee5502bbb354a4725e0fd0daa732e774e154ef9b9c9555c186bd52a2c9e2b964e5979a92f1210343ec0986eb1c21deb07c77f0f41b57c5d80da47500923cc503a1f5ec38e5e8d1b55fae0c9332a407d915debf6c42e25858994d388934", 0xcc}, {&(0x7f0000000140)="d20d46af7682ace831fb9e9d7a584651ee9a514b3f48c69e245158e3d7ae918e017e2307daf2e67a38ad99d948b11441813f9311506124c631e6d5628dc7873611b3990a2f6ab18cc7386d5b9d9f4afefd3e0557ee7a182fd4c5b5db8af2a5638132b5a8b29548a76236a2122015de7d2b355212f24b975b5262334164e436dea26a87cb4e2923cb03d1c0", 0x8b}], 0x2, &(0x7f0000000300)="ca5abcc835739a0e3954cf85a4b960a9b9b33839c9194cb07787e475c0c68b2278358965fa8774fa9bf6ceac9e907942711ef8fd867ee656965a7189c7428cd58caf383f5e6bd2b83ef0ea0a00650e5a9177bd670d58b7040d2eae55e722eb6bc3e2528e7db3015c4471ad23c098b5d505837cec7c0f3db788276a072b6fa2813d57ed7f681306ac61e6ae051efa42fefd7d3997952eff4817dd20e3c051ce1fe56c9e28064f22e87f1df9ac0d4d524bb5202b7be0aea8500bdda88d8d6334d02e855a429639b115bd6b746b1e55b6f74a9e6b4734f2f2bb719a6f04c131d8e9cbad20497b9e8ee10fc1daf7ce7e12cb78d4c0444f14f2f403", 0xf9, 0x4000800}, 0x804)

04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff00, 0x0})

[ 3565.853095][  T881] binder: 878:881 ioctl c0306201 20000280 returned -14
[ 3565.854073][  T882] binder: 879:882 ioctl c0306201 20000280 returned -14
[ 3565.896225][  T890] binder: 885:890 ioctl c0306201 20000280 returned -14
04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x300, 0x0})

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0x0, 0x0, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x2, 0x202800)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x15}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c080)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000008001700", @ANYRES32=r1, @ANYBLOB="050007002e39660ef1ab5d06080000000800310000000000"], 0x34}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20400600}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='\a', @ANYRES16=0x0, @ANYBLOB="000326bd7000fbdbdf250100000005002200000000000c000f00080000000000000006001d00fee70000"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0)

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x165}, 0x0)

[ 3565.921072][  T894] binder: 891:894 ioctl c0306201 20000280 returned -14
[ 3565.923314][  T899] binder: 896:899 ioctl c0306201 20000280 returned -14
04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x1000000, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x166}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000140)=[@free_buffer], 0x0, 0x0, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6, 0x0})

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x500, 0x0})

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x2, 0x202800)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x15}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c080) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000008001700", @ANYRES32=r1, @ANYBLOB="050007002e39660ef1ab5d06080000000800310000000000"], 0x34}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20400600}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='\a', @ANYRES16=0x0, @ANYBLOB="000326bd7000fbdbdf250100000005002200000000000c000f00080000000000000006001d00fee70000"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0)

[ 3565.927862][  T901] binder: 887:901 ioctl c0306201 20000280 returned -14
[ 3565.959679][  T903] binder: 902:903 ioctl c0306201 20000280 returned -14
04:22:02 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2000000, 0x0})

04:22:02 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7, 0x0})

04:22:02 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x600, 0x0})

04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x167}, 0x0)

04:22:02 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

[ 3566.020096][  T914] binder: 911:914 ioctl c0306201 20000280 returned -14
[ 3566.021234][  T915] binder: 907:915 ioctl c0306201 20000280 returned -14
04:22:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x168}, 0x0)

04:22:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_open_dev$vcsa(&(0x7f00000001c0), 0x2, 0x202800) (async)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x15}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c080) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000400000008001700", @ANYRES32=r1, @ANYBLOB="050007002e39660ef1ab5d06080000000800310000000000"], 0x34}}, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20400600}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='\a', @ANYRES16=0x0, @ANYBLOB="000326bd7000fbdbdf250100000005002200000000000c000f00080000000000000006001d00fee70000"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0)

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x300, 0x0})

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x700, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

[ 3566.025134][  T917] binder: 910:917 ioctl c0306201 20000280 returned -14
[ 3566.092957][  T926] binder: 925:926 ioctl c0306201 20000280 returned -14
04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x169}, 0x0)

[ 3566.097824][  T932] binder: 924:932 ioctl c0306201 20000280 returned -14
04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x2004894)

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff00, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x500, 0x0})

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4000000, 0x0})

[ 3566.107937][  T928] binder: 923:928 ioctl c0306201 20000280 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5000000, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16a}, 0x0)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x600, 0x0})

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x1000000, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

[ 3566.150793][  T940] binder: 939:940 ioctl c0306201 20000280 returned -14
[ 3566.164509][  T942] binder: 937:942 ioctl c0306201 20000280 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x700, 0x0})

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x2004894)

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16b}, 0x0)

[ 3566.181282][  T946] binder: 941:946 ioctl c0306201 20000280 returned -14
[ 3566.223372][  T954] binder: 947:954 ioctl c0306201 20000280 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7000000, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16c}, 0x0)

[ 3566.227534][  T953] binder: 952:953 ioctl c0306201 20000280 returned -14
04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff00, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x2004894)

[ 3566.248547][  T957] binder: 956:957 ioctl c0306201 20000280 returned -14
[ 3566.274685][  T965] binder: 963:965 ioctl c0306201 20000280 returned -14
04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16d}, 0x0)

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x2c}}, 0x4)

04:22:03 executing program 3:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x1000000, 0x0})

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfdfdffff, 0x0})

[ 3566.309239][  T968] binder: 962:968 ioctl c0306201 20000280 returned -14
[ 3566.315774][  T969] binder: 967:969 ioctl c0306201 20000280 returned -14
04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x2c}}, 0x4)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x2c}}, 0x4) (async)

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16e}, 0x0)

04:22:03 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x2000000, 0x0})

[ 3566.331978][  T977] binder: 974:977 ioctl c0306201 20000280 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff000000, 0x0})

04:22:03 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x2c}}, 0x4)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x2c}}, 0x4) (async)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x3000000, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x16f}, 0x0)

[ 3566.380812][  T993] binder: 988:993 ioctl c0306201 20000280 returned -14
[ 3566.395634][  T994] binder: 986:994 ioctl c0306201 20000280 returned -14
04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYBLOB="8b075405bc3b3e51f4a64e9e18c97144db13e523e88be7cefd47be36cfc397b6dd8fec409d547c5a8d96b02f028ab7134ffa36ec44d3ef00000000000003ffa050b2928b0e235fa515a1490fe44ac02e8cafbea2dbaf23f90a7c9b3ee8eb58ae5bb12384afc1febbdf413522725818"], 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x20000881)

04:22:03 executing program 3:
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfffffdfd, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x170}, 0x0)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x4000000, 0x0})

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7000000, 0x0})

[ 3566.402991][  T996] binder: 995:996 ioctl c0306201 20000280 returned -14
[ 3566.455516][ T1012] binder: 1009:1012 ioctl c0306201 20000280 returned -14
[ 3566.496504][ T1019] binder: 1014:1019 ioctl c0306201 20000280 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x100000000000000, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYBLOB="8b075405bc3b3e51f4a64e9e18c97144db13e523e88be7cefd47be36cfc397b6dd8fec409d547c5a8d96b02f028ab7134ffa36ec44d3ef00000000000003ffa050b2928b0e235fa515a1490fe44ac02e8cafbea2dbaf23f90a7c9b3ee8eb58ae5bb12384afc1febbdf413522725818"], 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x20000881)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYBLOB="8b075405bc3b3e51f4a64e9e18c97144db13e523e88be7cefd47be36cfc397b6dd8fec409d547c5a8d96b02f028ab7134ffa36ec44d3ef00000000000003ffa050b2928b0e235fa515a1490fe44ac02e8cafbea2dbaf23f90a7c9b3ee8eb58ae5bb12384afc1febbdf413522725818"], 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000) (async)
syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x20000881) (async)

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x171}, 0x0)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x5000000, 0x0})

[ 3566.502868][ T1023] binder: 1018:1023 ioctl c0306201 20000280 returned -14
[ 3566.574446][ T1034] binder: 1033:1034 ioctl c0306201 20000280 returned -14
04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfdfdffff, 0x0})

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x200000000000000, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYBLOB="8b075405bc3b3e51f4a64e9e18c97144db13e523e88be7cefd47be36cfc397b6dd8fec409d547c5a8d96b02f028ab7134ffa36ec44d3ef00000000000003ffa050b2928b0e235fa515a1490fe44ac02e8cafbea2dbaf23f90a7c9b3ee8eb58ae5bb12384afc1febbdf413522725818"], 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x800, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffff}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4800}, 0x20000881)

[ 3566.580135][ T1035] binder: 1030:1035 ioctl c0306201 20000280 returned -14
[ 3566.629397][ T1041] binder: 1038:1041 ioctl c0306201 20000280 returned -14
04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff000000, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x172}, 0x0)

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x300000000000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x6000000, 0x0})

[ 3566.639792][ T1043] binder: 1042:1043 ioctl c0306201 0 returned -14
04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x200000000000000, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x7000000, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x173}, 0x0)

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfffffdfd, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400fcff", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x5}, 0x10000}}, 0x18)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$nl_generic(0x10, 0x3, 0x10)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x40, 0x0, 0x2}}, 0x14)

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x400000000000000, 0x0})

[ 3566.650237][ T1047] binder: 1045:1047 ioctl c0306201 20000280 returned -14
[ 3566.730827][ T1059] binder: 1055:1059 ioctl c0306201 20000280 returned -14
04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x174}, 0x0)

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfdfdffff, 0x0})

[ 3566.753602][ T1060] binder: 1053:1060 ioctl c0306201 20000280 returned -14
[ 3566.757197][ T1065] binder: 1058:1065 ioctl c0306201 0 returned -14
04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x100000000000000, 0x0})

04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x500000000000000, 0x0})

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff000000, 0x0})

04:22:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400fcff", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x5}, 0x10000}}, 0x18)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$nl_generic(0x10, 0x3, 0x10)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x40, 0x0, 0x2}}, 0x14)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400fcff", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (async)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x5}, 0x10000}}, 0x18) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x40, 0x0, 0x2}}, 0x14) (async)

[ 3566.789076][ T1069] binder: 1066:1069 ioctl c0306201 20000280 returned -14
[ 3566.829287][ T1077] binder: 1076:1077 ioctl c0306201 0 returned -14
04:22:03 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x600000000000000, 0x0})

04:22:03 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x200000000000000, 0x0})

[ 3566.851735][ T1081] binder: 1079:1081 ioctl c0306201 20000280 returned -14
04:22:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x175}, 0x0)

04:22:03 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0xff00, 0x0, 0x0})

04:22:03 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfffffdfd, 0x0})

04:22:04 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400fcff", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x5}, 0x10000}}, 0x18)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
socket$nl_generic(0x10, 0x3, 0x10)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x40, 0x0, 0x2}}, 0x14)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400fcff", @ANYRES16=0x0, @ANYBLOB="0000000000000000000004000000"], 0x14}}, 0x0) (async)
write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x5}, 0x10000}}, 0x18) (async)
syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1) (async)
write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x2, {0x40, 0x0, 0x2}}, 0x14) (async)

04:22:04 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x700000000000000, 0x0})

[ 3566.928921][ T1096] binder: 1088:1096 ioctl c0306201 20000280 returned -14
[ 3568.251972][ T1335] binder: 1334:1335 ioctl c0306201 20000280 returned -14
04:22:04 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x300000000000000, 0x0})

04:22:04 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x100000000000000, 0x0})

04:22:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x176}, 0x0)

04:22:04 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xff000000}], 0x0, 0x0, 0x0})

04:22:04 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xfdfdffff00000000, 0x0})

04:22:04 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x400000000000000, 0x0})

04:22:04 executing program 4:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x200000000000000, 0x0})

[ 3568.338655][ T1348] binder: 1345:1348 ioctl c0306201 20000280 returned -14
[ 3568.414645][ T1366] binder: 1365:1366 ioctl c0306201 20000280 returned -14
04:22:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x177}, 0x0)

04:22:04 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x4044000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
ioctl$SNDCTL_SEQ_NRMIDIS(r5, 0x8004510b, &(0x7f0000000300))
ioctl$EVIOCGPROP(r5, 0x80404509, &(0x7f0000000b00)=""/4096)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, r3, 0x21}, 0x14}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='D\x00\x00l\x00', @ANYRES16=r2, @ANYBLOB="300b25bd7000ffdbdf2504000000050005000100000008000c00010000000500050001000000050007000200000006001d009b0000000500050001000000"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x1)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r3, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x19}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x80)

04:22:04 executing program 3:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release={0x40046306, 0xfdfdffff}], 0x0, 0x0, 0x0})

04:22:04 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0xff00000000000000, 0x0})

04:22:04 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x500000000000000, 0x0})

04:22:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0}, 0x178}, 0x0)

04:22:04 executing program 1:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000140)=[@free_buffer, @release], 0x0, 0x0, 0x0})
ioctl$MON_IOCQ_RING_SIZE(0xffffffffffffffff, 0x9205)
r1 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10, 0x0)
sendmsg$tipc(r1, &(0x7f00000000c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x1, {0x1}}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="52bdee21f85f78c23bbec806d3e861855ee4881467a0489b7914a3e4d21e8d60a82ff438c57d7bd5672b54830e8881792f38c7e823334304892fd52d76f9cfc17d54aac09d5713a28ae85b6b2004a7dfc6b39c8b6356b7e6dbc96d0fcfde028aa296a3d3663184f0dbd544cc94cbdac5192c0765bf1c0c7b3648d018e400ab3c3e6da557bcc1e5fe3104b805c7e182e473a6484273f230", 0x97}, {&(0x7f00000002c0)="3b3ba7e2e4e850c241febdb456380ff3b3015de2731ec9225e626c0c088b57572b2a611f13b2556070d2979e5d22b9e4e288d5db1c5debf0bd922a865b86e297fccdde9d1212e9d0520efae420b5c0819f63726bbb0499d2c5a939888b9b00f6e5770bb6", 0x64}, {&(0x7f0000000340)="ecc7c4b7bfa1edf3933c919c8d95f66c807e36bba428952f8d9c46a6766da1655fe8278935b8f331b5381649ec7d035ef7a813d84b73b83422e465842c8003b12bbb05311e7268918ebef302a6f6cc70a99a", 0x52}, {&(0x7f00000003c0)="19757d8418f986ba16d14a1935f7187ec216f28bae90b7c377838d9c170c5b7ad3b4a94709481b211daf17bf6353f02d1c98d3889bb3a531b478852c577005ed67b2450d5b834439c55099a67fd600ad4e16845a379446e6a1ba33c4c7625471c333d45847cec09c766163031255b1", 0x6f}, {&(0x7f0000000440)="a2d784127c09a9eeb023601bae84575b7973b5946ee27ced3fa82d70c50c123d1968bde54bbd3909c73324929a4bf17a0b83415f69f2198b2159f3c7bce74612df7c7cdbe1b1a9379323c0a9787464342a156930090908767fdee94571d9584308eb3ca8", 0x64}, {&(0x7f00000004c0)="8d8435679d3ab6b3d0fca98eb306e1f4bae662cc1387ca52f00f605b0f9f636ffa70ef57a7e06cf74692241653b2b13d48895eca9349df325534468aece1e84075b6d32d9c9761193c2b966f80ae44241fb282d4dd89d6503adffdcb18d09d9b4ce8dfa787863431a5c7a8b511ac75", 0x6f}, {&(0x7f0000000540)="2fedf5c8188ff19aa0787c88ec198c033632e22cb79429e0f26a067349714351d6972e94d8619e081825db999b62908e6b68d171be5d3bad73f068122745e85c567b1ddc9482885f32787c76f0c6ef9388eaa162f62a41a154a465c82fa689cb0931e246f183006ebf859f42dc10e2ad7fbc5fd3c5739e690aa7defaf563fe9704f65748d5971d180d9d3f0c2666f4663d7113cbcc5f3ada04b81b45f114595dd64362825a6b74529b0d011ec2e58e8cac0b069b136652e7f5d866c69b7ac2e738b30f678259eadacfb5b2e0", 0xcc}, {&(0x7f0000000640)="c807958637727562e2d08c31624f89a6d49efab7d24f554bf163acb86d2c4882175a95ad28fd8f855dc4634f4551a14c78a4e4d8a6f99cc334869cb8b7a24163db661a5465e28e0d76b39aff379fbd63a5392d4b61efce86b58e8221caeaccffdf68e3f3a8678c0be6126040fdb64a7a4ff2be59ff8e5730c44826959ac79fcb14b4c6810a4447c895bab5bcb63b406096135eea4eb10daf9bd8e9eb4c69e9d94e936c86530a245859b6", 0xaa}], 0x8, &(0x7f0000000780)="3e74e6c0d46e41d9291576ee1d24e7a4e41322f820a5db9f301091cea20c218813a69c94ad3620de0978a298ea04d87ffadb8c8268ddad73d577f894fa76f3374d07e78073c8ede22545cf64d1ba1870d20de6a8e12b84cbb683004400bfbce9be2788b14d065f8fb67d4d1f786a33d2dc0ddb3b3c356e862051f58017b39a62e62fe4e36e1d777aee9fe6b9d303b3b44c113ccf4bc5449d402fe84ada4e69f5eacbc2a5fa63349737c253019f7be778147336d3d5c5ad7b2b", 0xb9, 0xc800}, 0x880)

04:22:04 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x4044000)
r1 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r1)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_open_dev$vcsa(&(0x7f00000005c0), 0x0, 0x5551011bcc31e7b8)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r5)
ioctl$SNDCTL_SEQ_NRMIDIS(r5, 0x8004510b, &(0x7f0000000300))
ioctl$EVIOCGPROP(r5, 0x80404509, &(0x7f0000000b00)=""/4096)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x14, r3, 0x21}, 0x14}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='D\x00\x00l\x00', @ANYRES16=r2, @ANYBLOB="300b25bd7000ffdbdf2504000000050005000100000008000c00010000000500050001000000050007000200000006001d009b