[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 99.765971] audit: type=1800 audit(1552028812.817:25): pid=10898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 99.785090] audit: type=1800 audit(1552028812.817:26): pid=10898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 99.804524] audit: type=1800 audit(1552028812.837:27): pid=10898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 104.182404] sshd (11034) used greatest stack depth: 53616 bytes left Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. 2019/03/08 07:07:07 fuzzer started 2019/03/08 07:07:13 dialing manager at 10.128.0.26:43311 2019/03/08 07:07:13 syscalls: 1 2019/03/08 07:07:13 code coverage: enabled 2019/03/08 07:07:13 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/03/08 07:07:13 extra coverage: extra coverage is not supported by the kernel 2019/03/08 07:07:13 setuid sandbox: enabled 2019/03/08 07:07:13 namespace sandbox: enabled 2019/03/08 07:07:13 Android sandbox: /sys/fs/selinux/policy does not exist 2019/03/08 07:07:13 fault injection: enabled 2019/03/08 07:07:13 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/03/08 07:07:13 net packet injection: enabled 2019/03/08 07:07:13 net device setup: enabled 07:10:04 executing program 0: clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x37) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000000c0)={[], 0xfff, 0x0, 0x1, 0x1, 0xca, r0}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 292.185591] IPVS: ftp: loaded support on port[0] = 21 [ 292.352312] chnl_net:caif_netlink_parms(): no params data found [ 292.442374] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.448911] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.457924] device bridge_slave_0 entered promiscuous mode [ 292.467749] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.474389] bridge0: port 2(bridge_slave_1) entered disabled state [ 292.483065] device bridge_slave_1 entered promiscuous mode [ 292.519765] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 292.531741] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 292.570993] team0: Port device team_slave_0 added [ 292.580264] team0: Port device team_slave_1 added [ 292.777476] device hsr_slave_0 entered promiscuous mode [ 292.992505] device hsr_slave_1 entered promiscuous mode [ 293.277743] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.284372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.291577] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.298295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 293.374137] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.385611] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.426018] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.446728] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 293.454959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 293.470893] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.486459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 293.495402] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 293.505484] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.512018] bridge0: port 1(bridge_slave_0) entered forwarding state [ 293.564755] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 293.573931] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 293.583020] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.589541] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.597372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 293.606703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 293.616036] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 293.625335] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 293.634408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 293.643779] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 293.652903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 293.661589] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 293.676691] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 293.684780] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 293.693272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 293.706859] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 293.747234] 8021q: adding VLAN 0 to HW filter on device batadv0 07:10:06 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x300000000000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900400000000000000000000000030006000000000002000000e0000059d8fd57186fe8a010020001000000000000000002d8c77dda030005000000000002000000f00004000000000000000000"], 0x60}}, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 293.895113] ptrace attach of "/root/syz-executor.0"[11069] was attempted by "/root/syz-executor.0"[11070] 07:10:07 executing program 0: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000840)=""/148, 0x94}], 0x1, 0x0) pipe(0x0) write(0xffffffffffffffff, 0x0, 0x0) lstat(0x0, 0x0) getgroups(0xdddcd3744fa5afda, 0x0) lstat(0x0, 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r1, &(0x7f0000000700), 0x31f, 0x10400003) 07:10:07 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 07:10:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 07:10:08 executing program 1: clone(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) close(r0) 07:10:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 07:10:08 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) open(&(0x7f0000000180)='./file0\x00', 0x40, 0xffffffffffffffff) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 07:10:08 executing program 0: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000002400)=""/4096, 0x19) getdents64(r0, &(0x7f00000002c0)=""/243, 0xf3) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) getpeername$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000040)=0x1c) [ 295.984576] IPVS: ftp: loaded support on port[0] = 21 07:10:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x60a000, 0x8) bind$alg(r1, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x58) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12a41d88b070") r2 = syz_open_dev$video(&(0x7f0000000180)='/dev/video#\x00', 0x8, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0285628, &(0x7f0000000140)={0x1, 0x1, 0x0, "c01cbe43446705b818d1bfe74d57c9d4ffeb4b6a9f0c55000000002000"}) [ 296.179660] chnl_net:caif_netlink_parms(): no params data found [ 296.256228] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.262826] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.271241] device bridge_slave_0 entered promiscuous mode [ 296.287543] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.294147] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.302532] device bridge_slave_1 entered promiscuous mode [ 296.339938] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 296.351614] bond0: Enslaving bond_slave_1 as an active interface with an up link 07:10:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x93) openat$cgroup_subtree(r2, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) [ 296.385906] team0: Port device team_slave_0 added [ 296.395073] team0: Port device team_slave_1 added [ 296.455428] binder: 11123:11125 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 296.465886] binder: 11123:11125 transaction failed 29201/-22, size 24-8 line 3097 [ 296.473708] binder: 11123:11125 ioctl c0306201 20000440 returned -14 [ 296.487240] device hsr_slave_0 entered promiscuous mode [ 296.495016] binder_alloc: binder_alloc_mmap_handler: 11123 20001000-20004000 already mapped failed -16 [ 296.505346] binder: BINDER_SET_CONTEXT_MGR already set [ 296.510775] binder: 11123:11125 ioctl 40046207 0 returned -16 [ 296.517364] binder_alloc: 11123: binder_alloc_buf, no vma [ 296.523173] binder: 11123:11126 transaction failed 29189/-3, size 24-8 line 3035 [ 296.530775] binder: 11123:11126 ioctl c0306201 20000440 returned -14 [ 296.538009] device hsr_slave_1 entered promiscuous mode 07:10:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x93) openat$cgroup_subtree(r2, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) [ 296.606555] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.613192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 296.620331] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.626996] bridge0: port 1(bridge_slave_0) entered forwarding state [ 296.673783] binder: 11127:11129 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 296.684163] binder: 11127:11129 transaction failed 29201/-22, size 24-8 line 3097 [ 296.692022] binder: 11127:11129 ioctl c0306201 20000440 returned -14 07:10:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x93) openat$cgroup_subtree(r2, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) [ 296.765607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.789529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 296.799168] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.825369] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.844751] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 296.881526] 8021q: adding VLAN 0 to HW filter on device team0 [ 296.911655] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 296.921429] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.925920] binder: 11131:11132 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 296.927980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 296.938049] binder: 11131:11132 transaction failed 29201/-22, size 24-8 line 3097 [ 296.952343] binder: 11131:11132 ioctl c0306201 20000440 returned -14 [ 296.997204] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 297.005676] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.012263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 297.022690] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 297.032259] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 297.041209] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 297.049602] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 297.059925] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 297.072916] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 07:10:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x93) openat$cgroup_subtree(r2, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) [ 297.112662] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 297.216184] binder: 11135:11136 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 297.226639] binder: 11135:11136 transaction failed 29201/-22, size 24-8 line 3097 [ 297.234457] binder: 11135:11136 ioctl c0306201 20000440 returned -14 07:10:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) open(&(0x7f0000000000)='./file0\x00', 0x100, 0x93) [ 297.402643] protocol 88fb is buggy, dev hsr_slave_0 [ 297.409115] protocol 88fb is buggy, dev hsr_slave_1 [ 297.447349] binder: 11144:11145 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 297.458344] binder: 11144:11145 transaction failed 29201/-22, size 24-8 line 3097 [ 297.466207] binder: 11144:11145 ioctl c0306201 20000440 returned -14 07:10:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) [ 297.522957] protocol 88fb is buggy, dev hsr_slave_0 [ 297.529732] protocol 88fb is buggy, dev hsr_slave_1 [ 297.636254] binder: 11147:11148 got transaction with invalid offset (141287321108480, min 0 max 24) or object. [ 297.646792] binder: 11147:11148 transaction failed 29201/-22, size 24-8 line 3097 [ 297.654632] binder: 11147:11148 ioctl c0306201 20000440 returned -14 07:10:10 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000080)=0x8, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x81}, {0x6}]}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat\x00') connect$caif(r3, &(0x7f0000000100), 0x18) write$P9_RSETATTR(r3, &(0x7f0000000040)={0x7, 0x1b, 0x2}, 0x7) 07:10:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa000, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000040)) capset(&(0x7f0000a31000)={0x19980330}, &(0x7f00009b3000)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r3, 0x115, 0x0, 0x0, {{}, 0x0, 0x410c, 0x0, {0x14, 0x14, 'broadcast-link\xa0'}}}, 0x30}}, 0x0) [ 297.966621] binder: 11158:11159 transaction failed 29189/-22, size 24-8 line 2896 [ 297.974614] binder: 11158:11159 ioctl c0306201 20000440 returned -14 07:10:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) [ 298.116093] capability: warning: `syz-executor.1' uses 32-bit capabilities (legacy support in use) 07:10:11 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r1 = dup2(r0, r0) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) recvfrom$inet6(r1, &(0x7f0000000340)=""/90, 0x5a, 0x2002, &(0x7f0000000100)={0xa, 0x4e21, 0xcce8, @remote, 0x6}, 0x1c) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001600)='/dev/nullb0\x00', 0x42401, 0x0) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000014c0)=@abs, 0x6e) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={{0x0, 0x1c9c380}, {0x0, 0x989680}}, &(0x7f0000000300)) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f0000001540)) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000280)=0x2) sendto(0xffffffffffffffff, &(0x7f0000000140)="2e8f2fb61c354fd375008e2dfcb6c129c0827c705f07de0c58afae2d7075763773a91127b518351d27569c1dd29c97431cb79091dd56326487151ee53a890a268538d05cfda253c1de3651dee2da69a7ae085e5954afb278b936f2d8d3865f01ee6e01ff8161e71974941c91c0ba151d16471e414c02ca0d56945c", 0x7b, 0x0, 0x0, 0x0) write$FUSE_STATFS(r1, &(0x7f00000001c0)={0x60, 0xfffffffffffffffe, 0x2, {{0x15, 0x8, 0x2, 0x8001, 0x2, 0x8, 0xffffffffffffffff, 0x11a}}}, 0x60) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc01e00, 0x0, &(0x7f00000000c0), 0x1, 0x2000000000002) ioctl$BLKALIGNOFF(r2, 0x127a, &(0x7f0000001580)) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000003c0)='fou\x00') sendmsg$FOU_CMD_GET(r1, &(0x7f0000001480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800200}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x34, r3, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4051) [ 298.213386] binder: 11165:11166 transaction failed 29189/-22, size 24-8 line 2896 [ 298.221227] binder: 11165:11166 ioctl c0306201 20000440 returned -14 [ 298.252532] protocol 88fb is buggy, dev hsr_slave_0 [ 298.258015] protocol 88fb is buggy, dev hsr_slave_1 07:10:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:11 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x20000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000080)=0x17, 0x4) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x5111, 0x0) [ 298.498764] binder: 11173:11174 transaction failed 29189/-22, size 24-8 line 2896 [ 298.507882] binder: 11173:11174 ioctl c0306201 20000440 returned -14 07:10:11 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:11 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x400100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x100a}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000180)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @in={0x2, 0x4e20, @empty}}}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x781800, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'batadv0\x00', &(0x7f0000000300)=@ethtool_wolinfo={0x7, 0x1000, 0x6, "94bcba6f0002"}}) 07:10:11 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 1: socketpair$unix(0x1, 0x40000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x3, 0xc) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPOUT\x00', &(0x7f00000000c0)='Zuser\x00', 0x6, 0x2) write(r1, &(0x7f0000000380)="130000001000ffdde200f49ff60f050000230a009d000000119dc53022e5f9ec364f0000c0ff030000001c24e175cc463437101101bd81dc3181ddd83f8d3d1f2c53e45fca5ab94018975d7db75411543e1226408e88cac1f2cbefbb693d8a0c8efc28ceb4ec3ff429592e5de7e4f28bca763acd06f40ad03226af55e3129849ae2d726cf46a629bf91efdb19a5faccffe8090d92237be9951be4bd7c2a1c1a2b5b2684ade4025622c962d916c000000000000003400000000000000d5ba641663ac6847d35b8779c6903efd7800e86ccc2b5bbc156c2a1976a0f57350aeb0775fa06f769670fe98", 0xe8) 07:10:12 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 1: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) read$alg(r0, &(0x7f0000000040)=""/158, 0x9e) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) ioctl$VIDIOC_ENUMSTD(r2, 0xc0485619, &(0x7f00000001c0)={0x7ff, 0x1, "18a76018db542882b0c6776201ee260df0b51fd7cec79066", {0x10001, 0x6}, 0x80000001}) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x80, 0x0) ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f0000000200)=0xfffffffffffffff8) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000100)=0x9) shutdown(r1, 0x2) 07:10:12 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cuse\x00', 0x82, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x3, 0x20002) getsockname$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc) io_setup(0x5, &(0x7f0000000240)=0x0) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000380)) read(r0, 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="10000000f0ffffffff00000000855da0", 0x10}]) r3 = open(&(0x7f0000000040)='./file0\x00', 0x216001, 0x6) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000280)={{0xffffffffffffffff, 0x1, 0x2, 0x3, 0x4eb}, 0x1000, 0x2, 'id1\x00', 'timer0\x00', 0x0, 0xd2ff, 0x6, 0x4, 0x5}) [ 299.613020] protocol 88fb is buggy, dev hsr_slave_0 [ 299.618894] protocol 88fb is buggy, dev hsr_slave_1 07:10:12 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:12 executing program 1: setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x2, 0x250, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, &(0x7f0000000040), &(0x7f0000000540)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000d00000000000000000076657468315f746f5f7465616d0000006e7230000000000000000000000000006772657461703000000000000000000073797a6b616c6c65723100000000000094a3e9dd347e0000000000000000000000000000000000000000b0000000b000000000010000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000003f000000000000004c45440000000000000000000400000000000000000000000000000000000000280000000000000073797a3100000000000000000000000000000000000000000500000000000000000000000000000005000000000000000000626f6e645f736c6176655f310000000076657468315f746f5f7465616d0000007369743000000000000000000000000073697430000000000000000000000000aaaaaaaaaabb000000000000ffffffffffff0000000000fc00007000000070000000c00000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff00000000"]}, 0x2c8) r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @local}, &(0x7f0000000280)=0x10, 0x80800) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="2321202e2f66696c6530206370757365744024e42629656d3173656c696e75787365637572697473502e2062726f757465000a473968ccd9de7f0fca2d46"], 0x3e) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000100)={0x3, 0xa5, "04b6f76fb610f88b89eadef98c56d5a2d63213e6b4bd205f8d9cc51146169950120dc4a77067d70700d0327bdfe84737ba37c5f80e5a0f5243b2b505d3c9d8c3def33422081cc85f0f8f2d16c6705a93efb2a0be2524ae3754218bfe2847c6f168f072e34146aaf21a8b4a35623923b9ed121ea37d2fe6263060a14839af6eda42ac84ee6ff3085dac4ba37f0ca802fd7423b89d8d8e2aee815e73670b43d7dbe4d74e00d4"}) 07:10:12 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:13 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/4096) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000000c0)={0x0, @aes256, 0x2, "a923f9d83840ecc4"}) munmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x200002, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000080)=0x3) ioctl$EVIOCSCLOCKID(r0, 0x40084503, &(0x7f0000ffcffc)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000001100)={0x0, @in={{0x2, 0x4e22, @multicast1}}, [0x10000, 0x5, 0x5, 0x9, 0x100000001, 0x3, 0x4, 0x3, 0x0, 0x3, 0x8001, 0x5, 0x1, 0x8, 0x3]}, &(0x7f0000001200)=0x100) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000001240)={r2, 0x1}, &(0x7f0000001280)=0x8) 07:10:13 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0xfffffffffffffe43, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 300.267788] binder: 11235:11236 ioctl c0306201 0 returned -14 07:10:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 07:10:13 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f023c123f3188a070") mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0xfffffffffffffffd, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ftruncate(r1, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000002800), 0x8) [ 300.333021] protocol 88fb is buggy, dev hsr_slave_0 [ 300.338891] protocol 88fb is buggy, dev hsr_slave_1 [ 300.437749] binder: 11239:11240 ioctl c0306201 0 returned -14 07:10:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 07:10:13 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x8, 0x1, &(0x7f0000001380)=@raw=[@exit], &(0x7f0000001400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41f00, 0x1, [], 0x0, 0xf}, 0x48) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000040)={0x100000001, 0x81, 0x3d0, 0x6}) [ 300.577226] binder: 11245:11246 ioctl c0306201 0 returned -14 07:10:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:13 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="8907040400", 0x5) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x400, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000100)={0x1}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00\x00\x00\x19\x00', 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000200)={0x9, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040), 0x4) 07:10:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:13 executing program 1: r0 = socket(0x10, 0x80002, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000400)="39000000130009002900000000000000ab00804803000000443f0107020b0014180013000000649a83766fdf571f9f4f49ae55c4726e000000", 0x39}], 0x1) r1 = getpgid(0x0) get_robust_list(r1, &(0x7f0000000140)=&(0x7f0000000100)={&(0x7f0000000040)={&(0x7f0000000000)}, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)}}, &(0x7f0000000180)=0x18) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@multicast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@initdev}}, &(0x7f00000002c0)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000440)={{{@in=@broadcast, @in=@broadcast, 0x4e21, 0x2, 0x4e22, 0x0, 0xa, 0x20, 0x80, 0x0, 0x0, r2}, {0x4, 0x0, 0x1, 0x0, 0x8, 0x7fffffff, 0x1, 0x400}, {0x1f, 0x20, 0x8, 0x40}, 0x5, 0x0, 0x3, 0x1, 0x2, 0x3}, {{@in6=@dev={0xfe, 0x80, [], 0x22}, 0x4d3, 0x2b}, 0xa, @in=@remote, 0x3501, 0x4, 0x0, 0x11, 0x9, 0x8, 0x84e6}}, 0xe8) 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 300.990459] netlink: 'syz-executor.1': attribute type 19 has an invalid length. [ 300.998289] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.1'. [ 301.013183] netlink: 'syz-executor.1': attribute type 19 has an invalid length. [ 301.020779] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.1'. 07:10:14 executing program 1: r0 = socket$packet(0x11, 0x1000000000000003, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'ip6erspan0\x00', 0x0}) r2 = socket$caif_seqpacket(0x25, 0x5, 0x3) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r1, 0x1, 0xffffffffffffff14, @remote}, 0xfffffe17) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000040)={r1, 0x1, 0x6, @broadcast}, 0x10) lsetxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:mount_exec_t:s0\x00', 0x22, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) readahead(r2, 0xac, 0x24) r3 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x7, 0x400000) ioctl$UI_SET_RELBIT(r3, 0x40045566, 0x0) 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 301.236720] binder: undelivered TRANSACTION_ERROR: 29189 07:10:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 301.374170] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.499823] binder_transaction: 2 callbacks suppressed [ 301.499857] binder: 11280:11281 transaction failed 29189/-22, size 24-8 line 2896 [ 301.525509] binder: 11282:11283 transaction failed 29189/-22, size 24-8 line 2896 [ 301.534367] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.553020] binder: undelivered TRANSACTION_ERROR: 29189 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:14 executing program 1: r0 = socket(0x20000000010, 0x400000000080803, 0x0) write(r0, &(0x7f0000000000)="1b0000001a0025f00485bc04fef7001d0a0b49ffed000000806028", 0x1b) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x1, 0x0) ioctl$RTC_AIE_ON(r1, 0x7001) [ 301.676989] binder: 11285:11286 transaction failed 29189/-22, size 24-8 line 2896 [ 301.713406] binder: undelivered TRANSACTION_ERROR: 29189 07:10:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:14 executing program 1: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="5500000018007fafb72d1cb2a4a280930206e30100a843096c26234d2500080008000c00080010006300a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43a00220004bf0cec6bab91d4", 0x266}], 0x1}, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000080), &(0x7f00000000c0)=0xc) [ 301.823816] binder: 11291:11293 transaction failed 29189/-22, size 24-8 line 2896 [ 301.843867] binder: undelivered TRANSACTION_ERROR: 29189 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:15 executing program 1: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0xfffffffffffffffe}) write$binfmt_misc(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="73797a316f133458f638708d85a1511b3d0a602c3cb874a7ad4b3cdc8399b5fb374f8309a7ff6d9870dccb839ae8300887ca01c233b3095a2345472817cdda7100ddc19b80a75037e0cf7404407b8b8e52d01dbd7c8a85cb9fee23b0582ba893bc1a67f8ed28742446f69286d673781a21dc4aa0dd07b0867399084611aa4d855d9e7a1be58d4d1ba780e84617a4628d9fe3db38fccbe9eb85cca7ed8c3d26b5102f76cf126970d1bcae7ceb7b0fd673178f260b520245aff619d72dd2b5742a54429db2fcbab934608f96ad"], 0xbd) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000040)={0xfffffffffffffe01, {0x0, 0x100, 0x7fff, 0x800, 0x3ff, 0x6}}) [ 302.024394] binder: 11299:11300 transaction failed 29189/-22, size 24-8 line 2896 [ 302.050139] binder: undelivered TRANSACTION_ERROR: 29189 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:15 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000280)='cgroup.clone_children\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$VIDIOC_QUERYSTD(r2, 0x8008563f, &(0x7f0000000040)) r3 = dup2(r2, r1) pread64(r3, &(0x7f00000002c0)=""/135, 0x87, 0x0) [ 302.234193] binder: 11306:11307 transaction failed 29189/-22, size 24-8 line 2896 [ 302.244262] binder: undelivered TRANSACTION_ERROR: 29189 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:15 executing program 1: keyctl$set_reqkey_keyring(0x5, 0xfffffffffffffffb) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$describe(0x6, r0, 0x0, 0x2dc) [ 302.412977] net_ratelimit: 2 callbacks suppressed [ 302.412998] protocol 88fb is buggy, dev hsr_slave_0 [ 302.423880] protocol 88fb is buggy, dev hsr_slave_1 [ 302.442593] binder: 11313:11314 transaction failed 29189/-22, size 24-8 line 2896 [ 302.451389] binder: undelivered TRANSACTION_ERROR: 29189 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 302.613319] binder: 11320:11321 transaction failed 29189/-22, size 24-8 line 2896 [ 302.633197] binder: undelivered TRANSACTION_ERROR: 29189 07:10:15 executing program 1: r0 = syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000100)) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x40100, 0x0) connect$caif(r1, &(0x7f0000000040), 0x18) 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 302.795293] binder: 11324:11325 transaction failed 29189/-22, size 24-8 line 2896 07:10:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 302.926645] binder: 11329:11330 transaction failed 29189/-22, size 24-8 line 2896 07:10:16 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) r1 = dup(r0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = memfd_create(&(0x7f00000001c0)='y\xb6;\xb2(\x98\x9a\xbd\xbc\'\x94<\x93.\xbc$\x1f[\xeea\xbaY\xc4\xc4#\xf6%R\xf4\x83\xd9N\xc5$]\x13\f\x85\x87 \xf2mi\xeaK>\x03M\xd2\x004yZ\xca5k-\xc6\xcd\x01\xb5O;_\xe8\a\xf7aW8n\x1d\xaf\xf63\xa8_\x7f\xed\xb6*)^6\xed\x06\xfbF|\x98\xeaa\xb6\xaf\xf3\xa3!Y\xa72cN4\xd2\x15m\x1a\xd4\xa0\xb17\xabQ\x12\xd7\xb5\x0f\xaf\x14\xac\xac;\xb8\xaa,\x01WCD\xbd\xbf\x06;\xe4\x9d\xea\xe7PV\x81\xb8=\xb7\t\xe4\x06LQqTu\xbe*\xecy\x8eF\x90\xa3g*\xcd\x02\xb4\x85\xdaN\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\xf4\xf0CBT\xe9\xb2\x1a\xe5h\xbeOQ#\x06\x84\xa9\x95\x9e\x18\xdc\xf1\xf5O\xa8\x0e\x99\x8d\x02\xdb\t}\xcec', 0x5) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x5, 0x4d011, r3, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000040), 0x1) 07:10:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:16 executing program 2: socketpair(0x11, 0x3, 0x701, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x1, 0x40c00) r3 = accept$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000180)={r2, r3, 0x60, 0x12, &(0x7f0000000140)="29a76edc905124e30f2116e2967cbcabffd1", 0x3ff, 0x8, 0x1, 0x87, 0x1, 0x1, 0x5, 'syz0\x00'}) fsetxattr$security_smack_transmute(r1, &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x3) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f0000000300)) getsockname$tipc(r4, &(0x7f0000000400)=@name, &(0x7f0000000440)=0x10) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000480)=@sack_info={0x0, 0xda9, 0xffffffffffffff65}, &(0x7f00000004c0)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000500)={r5, 0x9}, &(0x7f0000000540)=0x8) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000580)=0x3) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000005c0)=0x8001, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000600)={0x0, 0x3, 0x8, 0x7f, '\x00', 0xc19}) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) getpeername$inet6(r0, &(0x7f0000000640)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000680)=0x1c) ioctl$VT_ACTIVATE(r3, 0x5606, 0x4) io_setup(0x28, &(0x7f00000006c0)=0x0) io_cancel(r6, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x295f0ac6, r3, &(0x7f0000000700)="09797b300f4b0ba331cae7dd58865e9eed3d2863a3edb42156b05c46216ca68942ddf6dd6f5ea8a7f35057cb6cbc8038eb83d70a6829beeaa72a6ee14dbdf006797a940330414c954692638d176ba598cc2123a0a7e2afdce342e2cbaf9ac8f93d012eeccbbc623f40eddffa25dc2ab4931f46d0c187ef7af3ce48e5070746fa90be22e3d871d7eb7e4eb0cef0ce87cdc83ef6", 0x93, 0x5, 0x0, 0x2, r2}, &(0x7f0000000800)) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000840)={0x9, "e5804f39d20c5a23979f90b84bf558d984079a3222b6e16eff365522477340dd", 0x2, 0x0, 0x6, 0x901000}) connect$vsock_stream(r2, &(0x7f00000008c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000900)={0x0, 0x0, {0x10000, 0x20, 0x2011, 0x0, 0x6, 0x8, 0x1, 0x1}}) ioctl$VIDIOC_G_JPEGCOMP(r2, 0x808c563d, &(0x7f0000000980)) ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000a40)={0x1, {0x4, 0x8, 0x0, 0x4}}) write$FUSE_WRITE(r2, &(0x7f0000000a80)={0x18, 0x0, 0x6, {0x6a7e}}, 0x18) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000ac0)) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000b80)={0xbd0000, 0x7, 0x4, [], &(0x7f0000000b40)={0x9b0b7a, 0xff, [], @p_u32=&(0x7f0000000b00)=0x6}}) bind$bt_rfcomm(r2, &(0x7f0000000bc0)={0x1f, {0x8001, 0x81, 0x7fffffff, 0x2, 0x7fffffff, 0x1}}, 0xa) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000c00)) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000c40)={0x60c, 0x7, 0x400, 0x1, 0x9}, 0x14) 07:10:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:16 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000080)=@nfc, &(0x7f0000000100)=0x80) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000140)={0x0, 0xfff}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYBLOB="01b70800f5030000090007080100d8004f0e000043d9b9a41ec6dc0bc427050731de2715ab530449fe81000000fa319571af45642a5af6561a67544f7eb227ce0a4e3460c36e19af77c0ce304cfe2d1e69e7431a8bd1bc921f86ce9326945d564323673d14e56204d900000000000000000000"], &(0x7f0000000240)=0x18) r2 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000180)=[{r2}], 0x2000000000000035, 0x6e0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000040)={0xfffffffffffffff7, 0x4, 0x4, 0x9, 0x1}, 0x14) prctl$PR_GET_NAME(0x10, &(0x7f0000000300)=""/207) r4 = dup(r2) ioctl$TIOCSBRK(r4, 0x40044591) 07:10:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:16 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x2, 0x0) r1 = dup(r0) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000040)="7f", 0x1}], 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000080)={0x79f, 0x0, 0x1, 0x856, 0x0}, &(0x7f00000000c0)=0x10) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r2, 0x8c90}, 0x8) 07:10:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:16 executing program 1: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x301200, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r1, 0x10e, 0xb, &(0x7f0000000080)="3fc40093", 0x4) write(r1, &(0x7f0000000140)="2200000018007c4e47d7b1ccff652186979f580700f417e512b87cba48c1cb65d145", 0x22) [ 303.773143] protocol 88fb is buggy, dev hsr_slave_0 [ 303.779205] protocol 88fb is buggy, dev hsr_slave_1 07:10:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 303.958162] IPVS: ftp: loaded support on port[0] = 21 07:10:17 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x100, 0x0) ioctl$VIDIOC_S_AUDOUT(r2, 0x40345632, &(0x7f0000000080)={0x3, "e08d7fcdf094ee5fa3fffe654d08f7e7918adec9e9a92d405a5ba9b2dd0e89a3", 0x3, 0x1}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000180)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in={0x2, 0x0, @remote}}}, 0x90) ioctl$VT_DISALLOCATE(r2, 0x5608) 07:10:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 304.219696] chnl_net:caif_netlink_parms(): no params data found 07:10:17 executing program 1: prctl$PR_GET_SECUREBITS(0x1b) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000040)=@sco={0x1f, {0x608}}, 0x3c8, 0x0, 0xfef6}, 0x0) socket$kcm(0x11, 0xfffffffffffffffe, 0x0) 07:10:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 304.328248] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.334939] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.343470] device bridge_slave_0 entered promiscuous mode [ 304.435410] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.442014] bridge0: port 2(bridge_slave_1) entered disabled state [ 304.450507] device bridge_slave_1 entered promiscuous mode [ 304.492920] protocol 88fb is buggy, dev hsr_slave_0 [ 304.498636] protocol 88fb is buggy, dev hsr_slave_1 [ 304.537988] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 304.554922] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 304.613341] team0: Port device team_slave_0 added [ 304.622507] team0: Port device team_slave_1 added [ 304.837326] device hsr_slave_0 entered promiscuous mode [ 304.992609] device hsr_slave_1 entered promiscuous mode [ 305.327409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.351339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 305.359217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 305.375455] 8021q: adding VLAN 0 to HW filter on device team0 [ 305.393991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 305.403983] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 305.412295] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.418792] bridge0: port 1(bridge_slave_0) entered forwarding state [ 305.473018] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 305.481248] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 305.490173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 305.498566] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.505171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 305.513185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 305.522863] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 305.532569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 305.541935] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 305.551124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 305.560561] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 305.569710] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 305.578375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 305.592857] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 305.601098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 305.609714] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 305.622873] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 305.673634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 305.733020] protocol 88fb is buggy, dev hsr_slave_0 [ 305.738847] protocol 88fb is buggy, dev hsr_slave_1 [ 305.852590] protocol 88fb is buggy, dev hsr_slave_0 [ 305.858096] protocol 88fb is buggy, dev hsr_slave_1 07:10:19 executing program 1: r0 = socket$inet(0x10, 0x800, 0xa) socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg(r0, &(0x7f000001d000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="2a0a358a2adb5fc9f5730502b3a0df2c281609ab34ad496ff97e4f3a4d706dbac9728f447f32ed226eb28baa8026e13521a005681c067eeb9826ec210705e36806014bc5448d0499463d3f755ff0a6d260127dda56977fe885a27f66f3daa0282f3de2bcc38334a4afdbb0eb04a36d596b3d0531ea2478afd99aa2712bcf527cd0cb65865ede243ac14b", 0x8a}, {&(0x7f0000000180)="c6b4f2675f63db90042335f60603557e913b14251bb63983adfcdbe22f7bb88db2708408dcd3851f5eb33b85aa8052a9b0aeb72fe01895345b9bcaa1c9792ea8c213968deaa03b521a81e678f930e3720137bd57177b56a00e382bf57a7b2b2e92d79b1e07889c020473d12b3d269b3298967c981761f294fd4c366ea74823310f2421ccb28c661712aa9e2f6398c0db", 0x90}], 0x2}, 0x0) 07:10:19 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x80000) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000140)) 07:10:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 306.779518] binder_transaction: 7 callbacks suppressed [ 306.779557] binder: 11390:11391 transaction failed 29189/-22, size 24-8 line 2896 07:10:19 executing program 1: r0 = socket(0x100000000a, 0x1, 0x0) connect$rds(r0, &(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}}, {{0xa, 0x0, 0x0, @mcast2}}}, 0x2c0) close(r0) socket$inet6(0xa, 0x80b, 0x5) socket$packet(0x11, 0x100000000000003, 0x300) [ 306.829468] binder_release_work: 9 callbacks suppressed [ 306.829485] binder: undelivered TRANSACTION_ERROR: 29189 07:10:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:20 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x80000) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000140)) [ 307.057375] binder: 11400:11401 transaction failed 29189/-22, size 24-8 line 2896 [ 307.112522] binder: undelivered TRANSACTION_ERROR: 29189 07:10:20 executing program 1: add_key(&(0x7f0000000100)='rxrpc\x00', 0x0, &(0x7f0000000180)="2a2a80751d16c09f26325945551a697397819f0f79b6fe67ac92692e83", 0x1d, 0xfffffffffffffffd) r0 = socket$netlink(0x10, 0x3, 0x3) fcntl$getflags(r0, 0x1) 07:10:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:20 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x80000) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000140)) [ 307.404913] binder: 11411:11414 transaction failed 29189/-22, size 24-8 line 2896 [ 307.445174] binder: undelivered TRANSACTION_ERROR: 29189 07:10:20 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000480)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0x14, 0x6, 0x1, 0x405, 0x0, 0x0, {0x0, 0x0, 0xfffffffffffffffc}}, 0x14}}, 0x0) prctl$PR_SET_UNALIGN(0x6, 0xc246102169ac7ecd) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x0, 0x10000, 0x3, {0xf, @vbi={0x0, 0x6, 0x9f, 0x7573567e, [0x8, 0xfffffffffffffff9], [0x0, 0x9], 0x1}}}) 07:10:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:20 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x80000) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000140)) [ 307.646504] binder: 11421:11422 transaction failed 29189/-22, size 24-8 line 2896 [ 307.676398] binder: undelivered TRANSACTION_ERROR: 29189 07:10:20 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000000000), 0x1000000000000165, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x1ff, 0x200, 0x308}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r1, 0x5}, &(0x7f0000000100)=0x8) 07:10:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:20 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3, 0x80000) [ 307.891165] binder: 11430:11431 transaction failed 29189/-22, size 24-8 line 2896 [ 307.923020] binder: undelivered TRANSACTION_ERROR: 29189 [ 307.933001] net_ratelimit: 8 callbacks suppressed [ 307.933021] protocol 88fb is buggy, dev hsr_slave_0 [ 307.943766] protocol 88fb is buggy, dev hsr_slave_1 07:10:21 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$video4linux(&(0x7f0000000100)='/dev/v4l-subdev#\x00', 0x80000001, 0x40) poll(&(0x7f0000000140)=[{r1, 0x8}, {r0, 0x18}, {r0, 0x100}], 0x3, 0x0) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000000)={'veth0_to_bond\x00', @ifru_addrs=@hci}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f0000000040)={0x0, @src_change}) 07:10:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:21 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 308.092851] protocol 88fb is buggy, dev hsr_slave_0 [ 308.098666] protocol 88fb is buggy, dev hsr_slave_1 [ 308.133914] binder: 11439:11440 transaction failed 29189/-22, size 24-8 line 2896 [ 308.166068] binder: undelivered TRANSACTION_ERROR: 29189 07:10:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:21 executing program 1: unshare(0x880000020404) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x804, 0x0) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_SG_TABLESIZE(r1, 0x227f, &(0x7f0000000100)) [ 308.372041] binder: 11448:11449 transaction failed 29189/-22, size 24-8 line 2896 [ 308.395367] binder: undelivered TRANSACTION_ERROR: 29189 07:10:21 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:21 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x80000000006, 0x1) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xfb28000000000000, 0x400000) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x50323, 0x2}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) fcntl$setown(r1, 0x8, r2) [ 308.607526] binder: 11457:11458 transaction failed 29189/-22, size 24-8 line 2896 [ 308.629103] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.652943] protocol 88fb is buggy, dev hsr_slave_0 07:10:21 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 308.658823] protocol 88fb is buggy, dev hsr_slave_1 07:10:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 308.838541] binder: 11467:11468 transaction failed 29189/-22, size 24-8 line 2896 07:10:21 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r1, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:21 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x80000000006, 0x1) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xfb28000000000000, 0x400000) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x50323, 0x2}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) fcntl$setown(r1, 0x8, r2) [ 308.883176] binder: undelivered TRANSACTION_ERROR: 29189 07:10:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:22 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7a, 0x0, [0xc0000080], [0xc1]}) [ 309.165342] binder: 11477:11478 transaction failed 29189/-22, size 24-8 line 2896 [ 309.221730] binder: undelivered TRANSACTION_ERROR: 29189 07:10:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 309.320198] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 07:10:22 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:22 executing program 3: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x80, 0x201) write$cgroup_int(r0, &(0x7f0000000040)=0xc69, 0x12) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000080)) ioctl$KVM_SET_PIT2(r0, 0x4070aea0, &(0x7f00000000c0)={[{0x8, 0x9, 0x4, 0x6910, 0x81, 0x4, 0xffffffff, 0x5, 0x7, 0xee, 0x8726, 0x67e, 0x8}, {0xffffffffffffff01, 0x6, 0xebd1, 0x2, 0x3, 0x3f, 0x2, 0x4, 0x9, 0x80, 0x8, 0x0, 0x4}, {0x1000, 0x1, 0x1, 0x1ff, 0x20, 0xab5c, 0xfffffffffffffff7, 0x3, 0x80000001, 0x2, 0x9, 0x0, 0x8000}], 0x4}) ioctl$VIDIOC_G_MODULATOR(r0, 0xc0445636, &(0x7f0000000140)={0x8001, "bdd99340f0347847802fb2d1cae13d86db105df81ebb494dc2f63abf43cf3e75", 0x80, 0xffffffffffffffc0, 0x80000001, 0x10, 0x3}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20-neon\x00'}, 0x58) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000240), &(0x7f0000000280)=0x4) getsockopt$inet6_tcp_int(r0, 0x6, 0x2c, &(0x7f00000002c0), &(0x7f0000000300)=0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000340), 0x0, 0x6}}, 0x20) ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f00000003c0)={{0x6, @addr=0x5}, 0x8, 0x6a3, 0x3}) fremovexattr(r1, &(0x7f0000000400)=@known='trusted.overlay.upper\x00') ftruncate(r0, 0x1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000440)={0x2}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x50000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, r2, 0x8, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x804) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f00000005c0)='caif0\x00') sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000740)={&(0x7f0000000600), 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa8, r2, 0x0, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8991}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x194b08f3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x11}}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x8840}, 0x40880) bind$inet6(r0, &(0x7f0000000780)={0xa, 0x4e23, 0x401, @mcast1, 0x9}, 0x1c) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000007c0)={0x0, 0x1f, "d51f339d53d877fd1ef14f505d4ac66c86d4574956cfed341dada5282831ca"}, &(0x7f0000000800)=0x27) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000840)={r3, 0x71}, &(0x7f0000000880)=0x8) accept4$vsock_stream(r0, &(0x7f00000008c0)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x0) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000900)=0x5, 0x4) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000940)=0x9, &(0x7f0000000980)=0x2) ioctl$PPPIOCGFLAGS1(r0, 0x8004745a, &(0x7f00000009c0)) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000a00)={0x1, {}, 0x7f, 0xc60}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000a40)=0x0) write$FUSE_LK(r0, &(0x7f0000000a80)={0x28, 0x0, 0x8, {{0x80000000, 0x8, 0x2, r4}}}, 0x28) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f0000000ac0)={0x0, @bt={0x1, 0xff, 0x1, 0x3, 0x4, 0x0, 0x7ff, 0x81, 0x2, 0x411, 0x1e1, 0x7, 0x7, 0xef5d, 0x4, 0x10}}) 07:10:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:22 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000280)) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 310.012978] protocol 88fb is buggy, dev hsr_slave_0 [ 310.018686] protocol 88fb is buggy, dev hsr_slave_1 07:10:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:23 executing program 2: openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x2, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 310.173120] protocol 88fb is buggy, dev hsr_slave_0 [ 310.178948] protocol 88fb is buggy, dev hsr_slave_1 07:10:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:23 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:23 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 310.842032] IPVS: ftp: loaded support on port[0] = 21 [ 311.111421] chnl_net:caif_netlink_parms(): no params data found [ 311.186209] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.192996] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.201386] device bridge_slave_0 entered promiscuous mode [ 311.210643] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.217280] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.225601] device bridge_slave_1 entered promiscuous mode [ 311.260095] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 311.271960] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 311.305907] team0: Port device team_slave_0 added [ 311.314797] team0: Port device team_slave_1 added [ 311.468916] device hsr_slave_0 entered promiscuous mode [ 311.604405] device hsr_slave_1 entered promiscuous mode [ 311.891914] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.898532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 311.905785] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.912392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 312.015249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 312.040304] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 312.054414] bridge0: port 1(bridge_slave_0) entered disabled state [ 312.065798] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.078954] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 312.105163] 8021q: adding VLAN 0 to HW filter on device team0 [ 312.141158] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 312.149620] bridge0: port 1(bridge_slave_0) entered blocking state [ 312.156245] bridge0: port 1(bridge_slave_0) entered forwarding state [ 312.164964] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 312.173406] bridge0: port 2(bridge_slave_1) entered blocking state [ 312.179897] bridge0: port 2(bridge_slave_1) entered forwarding state [ 312.204012] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 312.236617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 312.245936] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 312.256586] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 312.265715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 312.279104] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 312.296441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 312.305124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 312.326354] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 312.338761] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 312.349347] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 312.358058] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 312.414417] 8021q: adding VLAN 0 to HW filter on device batadv0 07:10:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:25 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:25 executing program 3: socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair(0x0, 0x2000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x1010c0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000140)={0x1, 0x0, 'client1\x00', 0xffffffff80000003, "bc54ff71318cbbdf", "f4826893c079543ba1093c65b414aad13960ca37f4a7d8a3a4e1c1c54f3ff060", 0x7f, 0xd6f5}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000000)='ip6gre0\x00') 07:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 312.706087] binder_transaction: 9 callbacks suppressed [ 312.706123] binder: 11544:11546 transaction failed 29189/-22, size 24-8 line 2896 [ 312.755925] binder_release_work: 9 callbacks suppressed [ 312.755942] binder: undelivered TRANSACTION_ERROR: 29189 07:10:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:25 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:26 executing program 3: r0 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r1, r0}}, 0x18) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc10c5541, &(0x7f0000000280)={0xcb2, 0x0, 0x200, 0x0, 0x0, [], [], [], 0x7, 0x9}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000b97000)={0x1, &(0x7f000048fff0)=[{0x6}]}, 0x10) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000140)=0x10000, 0x4) getsockopt$sock_buf(r2, 0x1, 0x1a, &(0x7f00000000c0)=""/1, &(0x7f0000561ffc)=0x1) [ 312.985751] binder: 11554:11557 transaction failed 29189/-22, size 24-8 line 2896 [ 313.041362] binder: undelivered TRANSACTION_ERROR: 29189 07:10:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:26 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 313.217871] binder: 11567:11569 transaction failed 29189/-22, size 24-8 line 2896 07:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 313.264268] binder: undelivered TRANSACTION_ERROR: 29189 07:10:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x8000000000000003, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="000302ffc7be0002e52200000000000000010000"], 0x14}}, 0x0) clock_gettime(0x0, &(0x7f0000004c80)) chmod(&(0x7f00000000c0)='./file0\x00', 0x8) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) recvmmsg(r1, &(0x7f0000004b00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x80000000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x840, 0x0) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000180)) 07:10:26 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 313.593332] binder: 11581:11582 transaction failed 29189/-22, size 24-8 line 2896 [ 313.641440] binder: undelivered TRANSACTION_ERROR: 29189 07:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:26 executing program 1: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:27 executing program 1: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 313.953384] binder: 11595:11596 transaction failed 29189/-22, size 24-8 line 2896 [ 314.013165] binder: undelivered TRANSACTION_ERROR: 29189 07:10:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 314.173822] net_ratelimit: 16 callbacks suppressed [ 314.173842] protocol 88fb is buggy, dev hsr_slave_0 [ 314.184675] protocol 88fb is buggy, dev hsr_slave_1 07:10:27 executing program 1: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 314.242771] binder: 11604:11605 transaction failed 29189/-22, size 24-8 line 2896 [ 314.271291] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.334541] protocol 88fb is buggy, dev hsr_slave_0 [ 314.340308] protocol 88fb is buggy, dev hsr_slave_1 07:10:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 314.505666] binder: 11615:11616 transaction failed 29189/-22, size 24-8 line 2896 [ 314.532887] binder: undelivered TRANSACTION_ERROR: 29189 07:10:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 07:10:27 executing program 3: ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000180)={0x0, 0x1}) write$input_event(0xffffffffffffffff, &(0x7f0000000140)={{0x77359400}}, 0x18) r0 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r0, r0, r0}, &(0x7f00000000c0)=""/83, 0x282, 0x0) 07:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 314.684094] binder: 11621:11622 ioctl c0306201 0 returned -14 07:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 314.812980] protocol 88fb is buggy, dev hsr_slave_0 [ 314.818873] protocol 88fb is buggy, dev hsr_slave_1 [ 314.822393] binder: 11627:11628 transaction failed 29189/-22, size 24-8 line 2896 [ 314.888787] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.895297] protocol 88fb is buggy, dev hsr_slave_0 [ 314.896013] protocol 88fb is buggy, dev hsr_slave_1 07:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, 0x0) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 314.945453] binder: 11633:11634 ioctl c0306201 0 returned -14 07:10:28 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40000000, 0x0) unshare(0x20400) ioctl$KDGKBLED(r0, 0xc0045405, &(0x7f0000a07fff)) 07:10:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 315.177449] binder: 11641:11642 unknown command 536871040 [ 315.183377] binder: 11641:11642 ioctl c0306201 20000440 returned -22 07:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 315.248775] binder: 11645:11647 ioctl c0306201 0 returned -14 07:10:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:28 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x400000, 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000040)) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000400)={0x2}) 07:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 315.566803] binder: 11657:11658 unknown command 536871040 [ 315.572608] binder: 11657:11658 ioctl c0306201 20000440 returned -22 07:10:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 315.883218] binder: 11671:11672 unknown command 536871040 [ 315.888962] binder: 11671:11672 ioctl c0306201 20000440 returned -22 07:10:29 executing program 3: syz_genetlink_get_family_id$fou(0x0) seccomp(0x1, 0x3, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x8000000010006, 0x0, 0x0, 0x50000}]}) r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x40200) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x5) 07:10:29 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 316.203345] kauditd_printk_skb: 3 callbacks suppressed [ 316.203378] audit: type=1326 audit(1552029029.257:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad8a code=0x50000 [ 316.230462] audit: type=1326 audit(1552029029.257:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 [ 316.252910] protocol 88fb is buggy, dev hsr_slave_0 [ 316.253549] protocol 88fb is buggy, dev hsr_slave_1 [ 316.263910] audit: type=1326 audit(1552029029.257:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 [ 316.289318] audit: type=1326 audit(1552029029.257:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 [ 316.310788] audit: type=1326 audit(1552029029.257:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad8a code=0x50000 [ 316.332486] audit: type=1326 audit(1552029029.257:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 [ 316.344009] binder: 11686:11687 unknown command 0 [ 316.353944] audit: type=1326 audit(1552029029.257:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad8a code=0x50000 [ 316.353989] audit: type=1326 audit(1552029029.257:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 07:10:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:29 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, 0x0) [ 316.354032] audit: type=1326 audit(1552029029.257:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad8a code=0x50000 [ 316.354075] audit: type=1326 audit(1552029029.257:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11680 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457f29 code=0x50000 [ 316.444962] binder: 11686:11687 ioctl c0306201 20000440 returned -22 [ 316.532590] binder: 11690:11691 transaction failed 29189/-22, size 24-8 line 2896 [ 316.557206] binder: undelivered TRANSACTION_ERROR: 29189 07:10:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:29 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, 0x0) 07:10:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 316.729231] binder: 11695:11696 transaction failed 29189/-22, size 24-8 line 2896 [ 316.798114] binder: undelivered TRANSACTION_ERROR: 29189 [ 316.863039] binder: 11701:11702 unknown command 0 [ 316.868087] binder: 11701:11702 ioctl c0306201 20000440 returned -22 07:10:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:30 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, 0x0) 07:10:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 317.300949] binder: 11710:11711 unknown command 0 [ 317.306113] binder: 11710:11711 ioctl c0306201 20000440 returned -22 07:10:32 executing program 3: r0 = socket$kcm(0xa, 0xfffffffffffffffe, 0x73) sync() write$vnet(r0, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) 07:10:32 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, &(0x7f00000000c0)) 07:10:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:32 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x900) ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x0, {0x5, 0x796c, 0x1}}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000080), r1, 0x0, 0x1, 0x4}}, 0x20) connect$l2tp(r0, &(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x1, 0x4, 0x0, {0xa, 0x4e21, 0xc53, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1f}}}, 0x3a) nanosleep(&(0x7f00000001c0), &(0x7f0000000200)) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000240)=0x6) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000280)={0x6, 0x5, 0x6, 0x8001}, 0x10) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000002c0), 0x2) ioctl$LOOP_CLR_FD(r0, 0x4c01) r2 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) fchownat(r0, &(0x7f0000000300)='./file0\x00', r2, r3, 0x1000) write$P9_RLCREATE(r0, &(0x7f00000003c0)={0x18, 0xf, 0x2, {{0x40, 0x0, 0x2}, 0x20}}, 0x18) ioctl$KDDELIO(r0, 0x4b35, 0x7) r4 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000000440)) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000004c0)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e20, @empty}, 0x40, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)='netdevsim0\x00', 0x6, 0x5, 0x1}) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r5, 0x1, 0x22, &(0x7f0000000540)=0x1, 0x4) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000580)) ioctl$TUNDETACHFILTER(r4, 0x401054d6, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000680)={@pppoe={0x18, 0x0, {0x4, @remote, 'netdevsim0\x00'}}, {&(0x7f00000005c0)=""/108, 0x6c}, &(0x7f0000000640), 0x7a}, 0xa0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000740)=0xf49, 0x4) modify_ldt$read(0x0, &(0x7f0000000780)=""/219, 0xdb) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000880)={{{@in6=@mcast2}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000000980)=0xe8) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000009c0)={0x7f, @multicast2, 0x4e22, 0x0, 'lc\x00', 0x0, 0x2, 0x21}, 0x2c) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000a00), &(0x7f0000000a40)=0x4) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000a80)={0x5, "adc80dc365a5c5044815d9fa11fa4e75834ce2cda7352006cf82cf2e6ebd00f0", 0x1, 0x1}) [ 319.263544] binder: 11722:11726 unknown command 536871040 [ 319.269355] binder: 11722:11726 ioctl c0306201 20000440 returned -22 07:10:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:32 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, &(0x7f00000000c0)) 07:10:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:32 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x8000000000000001) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f00000000c0)={0x0, @aes128, 0x0, "3d3e5bdda61807f0"}) geteuid() getgid() getgroups(0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f00000002c0)='/dev/vcs#\x00', 0xc1e, 0x42002) write$sndseq(r0, &(0x7f0000000340)=[{0x3f, 0x7, 0x1, 0x200, @tick=0x6, {0xbf, 0x3}, {0x0, 0x9}, @quote={{0x8, 0x9}, 0x0, &(0x7f0000000300)={0x101, 0x0, 0x81, 0x1, @tick=0x7, {0x4, 0x100}, {0xf2d, 0xffffffff00000001}, @quote={{0x7, 0x2}, 0x1f}}}}], 0x30) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'veth0_to_bridge\x00'}) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xee6b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) linkat(r1, &(0x7f00000003c0)='./file0\x00', r0, &(0x7f0000000400)='./file0\x00', 0x1400) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000380)) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000440)="76f4f78f72a723a69c34e9b69a409eae877425b5a7706c2061eca379f3895b7e66f45b4f166b71aef4b2d5e72a1cfb64bac7939aad4888ff498102cfbda86ee10446f610f5e19af711363c9166b0") r2 = memfd_create(&(0x7f0000000140)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) lseek(r2, 0xffffffffffffffff, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000004c0), &(0x7f0000000500)=0x8) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') sendfile(r1, r3, 0x0, 0x1) [ 319.558919] binder: 11732:11735 unknown command 536871040 [ 319.564805] binder: 11732:11735 ioctl c0306201 20000440 returned -22 07:10:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:32 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x0, &(0x7f00000000c0)) 07:10:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 319.905344] binder: 11744:11746 unknown command 536871040 [ 319.911134] binder: 11744:11746 ioctl c0306201 20000440 returned -22 07:10:33 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000180), 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x5, 0x0, 0x0, {}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "388dbba2b150d176"}}, 0x48}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000005d40)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000000040)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x8, @can={{}, 0x0, 0x0, 0x0, 0x0, "c4d981ae211e6951"}}, 0x20000108}}, 0x0) symlink(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)='./file0\x00') close(r0) 07:10:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:33 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[0x0]) 07:10:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 320.380644] binder: 11762:11763 unknown command 536871040 [ 320.386422] binder: 11762:11763 ioctl c0306201 20000440 returned -22 [ 320.412692] net_ratelimit: 14 callbacks suppressed [ 320.412710] protocol 88fb is buggy, dev hsr_slave_0 [ 320.423488] protocol 88fb is buggy, dev hsr_slave_1 [ 320.471121] IPVS: ftp: loaded support on port[0] = 21 [ 320.573048] protocol 88fb is buggy, dev hsr_slave_0 [ 320.578929] protocol 88fb is buggy, dev hsr_slave_1 [ 320.768242] chnl_net:caif_netlink_parms(): no params data found [ 320.841513] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.848107] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.858494] device bridge_slave_0 entered promiscuous mode [ 320.868696] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.875340] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.884759] device bridge_slave_1 entered promiscuous mode [ 320.920051] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 320.932041] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 320.967233] team0: Port device team_slave_0 added [ 320.976462] team0: Port device team_slave_1 added [ 321.068180] protocol 88fb is buggy, dev hsr_slave_0 [ 321.068702] device hsr_slave_0 entered promiscuous mode [ 321.074016] protocol 88fb is buggy, dev hsr_slave_1 [ 321.132472] protocol 88fb is buggy, dev hsr_slave_0 [ 321.137914] protocol 88fb is buggy, dev hsr_slave_1 [ 321.192812] device hsr_slave_1 entered promiscuous mode [ 321.359762] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.366390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.373653] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.380202] bridge0: port 1(bridge_slave_0) entered forwarding state [ 321.489237] 8021q: adding VLAN 0 to HW filter on device bond0 [ 321.516678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 321.526354] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.537409] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.554094] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 321.576291] 8021q: adding VLAN 0 to HW filter on device team0 [ 321.597742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 321.606181] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.612767] bridge0: port 1(bridge_slave_0) entered forwarding state [ 321.643507] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 321.652187] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.658673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.684968] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 321.720564] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 321.729398] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 321.738395] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 321.747792] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 321.764578] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 321.811663] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.882775] protocol 88fb is buggy, dev hsr_slave_0 [ 321.888545] protocol 88fb is buggy, dev hsr_slave_1 07:10:35 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x29a) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000000)) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x2, 0x10001, 0x1}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socketpair$unix(0x1, 0x800000000003, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 07:10:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:35 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40206417, &(0x7f00000002c0)={0x1, 0x4, 0x101, 0xfffffffffffffffc, 0x404, 0x2}) r2 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000440)="fa147d4d7f7da2d69a156c251e475fbfdc5456e785db5d81a8b86a69e22555270c18520ead57cdd69bde0b1860e9e9adc6d3602930499c07eb48d5d82b9c13c8aac5fd78eb28b123968cb1d8f53c3647264565f789c7715500b2b10118ae32c6b94c5e918bd8440e1e9fd4c9e29fa92659644fa240aad01795d47a39c20ab967e1a8db6e0dfb516d3c9f66438256a9b502d7ea2dd16595715f06bd272edaef02d0235a195d8bfb2a38e1afded943ecc840e25278c1435faf4c51077fa4a291da48678f696405716ff326e7944314bffa252cefbad553f557da4f1e6cf674e267f4ff896db2c7fe1f574a4b5f639e6704da58e2cc00b0b5182d6bae2a4b64d600da0468dc4ff69b559f4dc33b77664c188e197f37224e64eb653fb88ffc1c861b89c8411f65bdbf4e81f793e4fd8f288f0c5bfaf6bfe018d53392ff1f40e26292381a414498ca1ff813672a3910eb1811ef1418ffca4c5930e9954629b83140a9e519b509a7af184a6d9cef75d882bbc2951ade60b3f554800d0f4549bfb05aee189f047fe9da69946f73924ea7f4e6816cdf1f702fb970e2e054f58eb9885fd8e982e5b54fe2a2badb28de4febbd54f5cbbe72d00e551a6ed15c884b13c3fa8708de91d9ede7f9071fb872686c481c8464a4e5f65dbf5487db64d4dc4718fbe9172090aa8169eea2a0624f68edf9439f1063e18eb4a8d7f400f1415c969f30cdb51b11317eac0ab0f18f124e2d9f0504f74199376803f417bc437c5ed7fa99502de72bd8d5b56ae069b6641fe9eb5ff9a022b585e482b70f7d9ea1097912a31c5dc8b98d16b3c088b793ea8bfe3efdabce2d96fb28d6042d81457a2611583313266c62987d6d23f34556ba657117f01dfd3b013ae50431c002d705d29b2eaac8dae7298cb780cbef5e1827a533a85e21c279c835c985e254dc454cbdebbbbd904769570a99e1dc076e912deacbf0d0861e4f7a6f7cc137a36d8c2af7fe1e840e42294ffda95263380da5256aeabde954ec5881d183bdff8edb99f1357326affd2c3f12f3f1af2d912741a75632f0cefec1024d620f17da4da95e8a7d43ddfc13c26a7d3f19b0d310d6b0d01ba0836770b00793d275de5b5601f90fb7f0be7a4e6c86aafe3dd973e83da4d8bf7396f5be7c1da1002cca0d443088225b93cb5354f82990674ce3a10e59c8fe04a7e0177e753f94ba3dcbccedf466bd36f0d43ed7b03609e5f2c42ba47b4480f18d5e70c22ca6a484e6e1588833fee6b782f8337ae53f5b66f8a453b2b896bb0361c3bdb623d5dee86cd056fe825e376888963a973b03bd61ffe87df5bc077e5ca903ccada55f692257f211c69cb5bbe61c0c99b5a0d358211e950ba5405c020279b9e01928218902f3fed3714852efe41b45ab01f3f0d86aacec526f016de8992a59a71cdc4bb042ac62910de61dd061df92c8b780a6b89d44b2d1b57588ad753b97d3c7d2343a8b94331ea46c5efbe3de9a0a704f41e081ba6ee57a0f73617cff0d42def2527d08be92614e4c12801fd86f800ddf0cc823691a6dada77ff01055d76a63b8dab7451023d7a2009b2595a4d7aecc9986701266477bbe7d06b4ebd5f5d93518496e72e9e6dbe7e8f8a358eb26af9ea9587e7a3951c2c23f981ecfa3e2f1d39c9ac43fe8afb3d0515a9f351604e01a7edd62f49c2c590d926dea36a6854109c4d1ffe6370416ff3a362e90b4dc17f31907f7e78f7ae6571c571a2cfe0d2a96f0a10e3d264f550e7c462e9d312381bb0151ad4183beed318970f7228d7a666e7bbb26a1f08e412eb44d2bd354e7eaef86345649238969009f14089c51af19e606fb15355f7b553f42a07fac93c0a515f02232e4ddf76c2b4a91c9e6a0c8eff6c9d013643eb9fcc01401a8d4a2af0b6f1d05466eb8eb238990f469b310a66d410f2d6ed83a4468160b31fd33ed51ea2dce3519d1f5e334ae52d0b6c6180b485ed42d59e5f0c29e7db78dbda5a9504446bcc348ab4b5dcf188bc0b816eee1e52bbc4b58ab454695f34a61f4b19bf637eafd2d0211228abe0c99505e47152d82555a13989fc0691a4d7350a3da0be55df13fceb7f1aa62a89143bb27bbef259e4399be8bdec8e7031a56020e9d2431870fd64c0707e27a020ea4384a9060eedaa590df3a1912d9bd6f90c1d880b9c811a272381c26896e84fe3533aad4d721948f4eef56ae3c354f06b55afa25a8ea65b9ba5e1d34ca6a20969b44a3f96674d9ce367a2525e2b069b57d3a76e52b4ccae2e7a13bc0519028fe2efc9ad22e4acbe8bace48f2d149f909a660554846d85eeee8c7cab28a0cf9de9eb9a738cbc018bd6209c0ad041387a00d4eb49561237c98a0b4ae1354d63dadf11909bdb2eb2e379839cb063dacab1b2b0ce091866feec438846ec2c6b2f33d723b724988065aefc4b5731235fa2cbea8bfe5031ec4fa1bdccb25fee73c279854273b79d0e41b753bad40a1d8854a918ae71313e29ec4489c1839c42f8baa43b274d2b27f150524aa9a8cf0b7954b5368446d609441095983f3d3d6466ce64fdc7af87f06fad1d673711e532aa06dbf3464c35fb0ee14ae9746d6e629238d6c5ed087f832d381565bc89c438420789ddccae2d41ce72fdb20e4bca8e4d0e2f225755d045f92ba459e0d432b4f92bfdc4c59cfeeba1939521c11176c7c3a4a981daffca7f85fbf64e9fefc292ee04b3c7e1e653af971d609df94ed9ea5713ed232d634545d50194569b319edcc509751ae9aeeac6cbd5a4c3ddea883f160353b1094bff038f3b0fdf1a75ca9062ec8ff6f6f6f5f9b73332924dd8668f569a97e8f5e85fe0e6723ce4935b016c185b9df2512cce4c9142ad73883588bfea79ed65242fe02f4c7c98093f4c37e0bc57ef4a4a7256da8b6ff0351acacaf7a75a2e4a3c78b838e1796646c1b92933f61b95a9f8054036463ec10a42b62c8b6d331b17a5c1fb3844f32ae6d22249fce2d3de36e6c6dac2ab9e357a262cf7ebe862e1dd6265a43c3f78dc0ba5afdce82a14072b4fef516cc70342d7dba34cc99d390f50ff62da60f4ea9884173bf54a1cb41fff318d4a5915d1979c30732c7944f76e7812117cbafd33f0d8404bacf4f0e26bc0da9bc60a1273200e7a4746a7ef44fc54e486d1cf738a5151a85d179cdeb6adc9c66dd06c996e198c5bc5ae6b6000c67b916a83a20b3309632e58b8b7b7d09b6cc43f4e6218bffc383f74805edfe33aaf82fcf7fd0f84bc31104899638aac3c9e232d38471e28c020402b78930ff03f13016f0ae7403a5c4b8c4bee1aaa6344aa389caaa488833722f921a79cf67f90e81dafa24e87fd827bee4cc3b4d0065bc988e6f01514897cec6a6e7542b7870f057411eecc230dd8df22f52861409da97624386ee84cd5010b38d30443a69f11decac7dfb119e46a89e9c0e5e6c0792c559d355de9523fd40ce1859e9782e379fcf7a11067813b37442604ab7e70ded52b163f633b3deae60f140ad9ea031014c316aad1bf35c6cd00e2ad0c3fd3ed19b1f1e362736318ac22732f14db41783888c980dd66589fbcb96c2e688c7023d8b851e51a1acf7bd102a1f8330fdba4f3c8d019851373ad069779ce51456844fe145e7db3c3c2b4488a1ba887bf66ee5d35da2230b7721e07ea960acbeb8f9fe72619f768b21a72ccaa23f2db34a5325c4a92987d9126b567ca8e0a8dbff89461e204ebec438125610ab1670cbe2ecd7b7fe979064c91bc82bc38924f219a96d15977dafc7a3c1332f3a9edecdfcb6ee7e5eedc715061b31bd2c462170a6f4c3909e41afe15efdaeebd40164c5329eb80d217986da2dc7d16a62f3b82716b611a60c3d273cc05b6a56d712de083e162bc3790ca6ba2b419f68baef0e2f40e0a4b54a26817a8c2789ea8b42f76a968e33e1924dc54676dfbacc36e7879219f51777a1603e9e347f03bfd2c98a7ad83de9bead9cea0074ec054114e5efd33f23765de549613978693bb80deb066409a54a9e2ab204d374e2405e0e73335566614b82393ba8eda259baa63b034763bfc460b8880ada973f523e5faf2dcaa9315409f2079d10a864112ed974f0e596d933343f4df0cd8fbc84d6681535aca975a5b5bae9d21b0147561dcd2d7a1355f11d9b9d2c882c23cb4886ecf4f97f88743101920729980f9d398e614f46c0f1d79f02446b9865976036256cd0a13cb2c6975a519b917bd723c59598104947e3a086a669e72b29e96d9de95d852a98f31218ae8d07fffb2a877b5253f6eb34499831fe9062c8229218d3d027869aa1647129538db4e82b5a69731f88e48fd0ffc15094e7f2b267b7b2e8f3451f1d817188c5909b21a4d09edf234cf781c28390044070a7c792645495e53a4ae2ddae03a2db4169bc61d93a04ffa56890ffc0e86deae9d71b47110e769d255169218c0e65fc50e6d6d9ac868efc63697e335ec763809096f3a0ef47e3357aa57559043b1a29147926292d0aba000d77229db0a3185b79135c0ddd932328d4c72dda39cb4ef08ffc3ca2144ecbf813282c21accadb9af5abbb8e02aa7af4b53641f822c07b1ebe23922a5c9eaab747d183416c1f9f9d4e59e82bf545f3ecf05821353c618d0d9b3ee796f2cdaba1cd23fc64f795a900960d7bce150146b9387e99185cda3d5bc19cd212a98190c7bea429eb5fd3022a3675073bc259213bdd827c9cb7e6b5d3f7a02419ef27121c3eca57fe26bf88b38809a7c75efbe07e8b07e690f1c370a8f6bbce490cf17c1fd0c68dd9484591d5bcd3b681a74f19becbdb4f1792d9dd85618b3859e5458d795cf71bf39c644c4ebafe83c1da2172933e774e6e079debdadd76df55da68b01fed88917cbd0ee164c73f2b2afda2ecfb5e1bea56f3170464ddb24f05fa80eddece0fcb753df890afa81807163953a00957c356f6cade1ee58cfd48cb3767bca9cd2926268efbf3af5d0c1460b9182280205d0630eae2c45457382b042d3d9b11b91ed2358b2e7e28aac7c613babe15318dc21c7bec6bc6ab929e3613deb23ad41a88c55909337a40a02d3437aa0ab8b5348f45669e256b5d7bd2068212e61fb6d3eeccc380586d5c3cdecb4e025cc5fb7ac4f5f0f138d836418f09a2f2e67732d281f21bd98af56e395883f1db25c44c4657602e3db96ee56371bce2db11c23947b06b2016532a726c543d9f10972d81bf7c159c64242adceadba25360b944bf8abf3ad2fe0bdd5c81a50944aa704eeb69cf663f8060e922ce83a0056501a19263ef1aab3e6101ee3bf9fa6014711d122f37315783a2f5e1957ff2b39dc8500372d6f7b4be2e5eaf7b809d38121b9c374f43832b62a82507288436416a731830f843fbb7d3033d3d68b4450997506570d8e7f90c00d91f0e25e66adb6185b7285ab9e4c946c805bb564d2c39be58a6ef0a5b80e71985513964335790d654c20086b7d0b2853dc2b9b764fdfcc706d2100ef52309250d65089a2475be1baefd921f7628ec859b386f43bc5e1ea3399fb0b06b994ff616e6b60b0b6b2d726bec83f17042bf0240e3a55a6aac7e3cfc4da0bcc34d2307cc272113916e2cc623b46c4c177b3b5cedd8b2e691a3004f4038cfc6714f2b966fb4d41750ee1635278f1eb1f6a9ae851236a6f6850448547ec06d6db307ad851ce6637a7452dfa6a1ea7a0a4a2acebccff1afdf1841ccd4105c8e7bc144fe51aa083c265bd678a0c33a89bfe0c0413a430dec4754ae33e3566e774be399eeced8671bf0b7b94089852e3380a35c36059189c8262cfda42e028f0eecb0b0afa765ae92b99f1964a07a02741931", 0x1000, 0xfffffffffffffff9) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000100)={r2, 0x87, 0x4}, &(0x7f0000000240)=ANY=[@ANYBLOB="656e633d706b63733120686173683d7368613338342d617678320000000000000000000000000000000000000000007760edbf655bb3218e8887cd7b74280000000000000000000000000000000000000000000000000000000000000000"], &(0x7f00000001c0)="3963178c2ee12aaf37a4350fd06137307d31df8b543bf215584c46ca0d7ad03cd1dd0dba3875c5a3827157", &(0x7f0000000200)=""/63) preadv(r0, &(0x7f0000001500)=[{&(0x7f0000000340)=""/21, 0x15}, {&(0x7f0000000380)=""/190, 0xbe}], 0x2, 0x0) socket$xdp(0x2c, 0x3, 0x0) 07:10:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:35 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[0x0]) [ 322.507916] binder: 11778:11784 unknown command 536871040 [ 322.513834] binder: 11778:11784 ioctl c0306201 20000440 returned -22 07:10:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:35 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[0x0]) 07:10:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:35 executing program 3: r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x9, 0x200) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@int=0x3, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0xa, 0xf0ffffffffffff}]}}}]}, 0x3c}}, 0x0) [ 322.804279] binder_transaction: 1 callbacks suppressed [ 322.804317] binder: 11791:11793 transaction failed 29189/-22, size 0-0 line 2896 [ 322.866245] binder_release_work: 1 callbacks suppressed [ 322.866262] binder: undelivered TRANSACTION_ERROR: 29189 [ 322.886428] binder: 11795:11797 unknown command 536871040 [ 322.892294] binder: 11795:11797 ioctl c0306201 20000440 returned -22 07:10:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 322.988135] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (18446744073709551615) 07:10:36 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x0, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 323.099885] binder: 11802:11804 transaction failed 29189/-22, size 0-0 line 2896 [ 323.183988] binder: undelivered TRANSACTION_ERROR: 29189 [ 323.384948] binder: 11811:11814 unknown command 536871040 [ 323.390651] binder: 11811:11814 ioctl c0306201 20000440 returned -22 07:10:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008915, &(0x7f00000000c0)="0adc1f123c123f3188b070") pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000080)='threaded\x00', 0x9) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000140)=0x2, 0x21f) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) socket$inet6(0xa, 0xf, 0x3ff) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000000)) splice(r1, 0x0, r3, 0x0, 0x10002, 0x0) 07:10:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0xa0200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x36) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000040)=ANY=[@ANYBLOB="5bf6f7"]) ioctl$int_in(r2, 0x5421, &(0x7f0000000080)=0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000028000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0) 07:10:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:36 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x0, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 323.602541] binder: 11817:11821 transaction failed 29189/-22, size 0-0 line 2896 [ 323.639725] binder: undelivered TRANSACTION_ERROR: 29189 07:10:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 323.814747] binder: 11830:11831 unknown command 536871040 [ 323.820383] binder: 11830:11831 ioctl c0306201 20000440 returned -22 07:10:36 executing program 4: io_setup(0x8, &(0x7f0000000000)=0x0) r1 = socket(0x2, 0x803, 0x3) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) io_submit(r0, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0, 0x3cb}]) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x7fff, 0x4) r2 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000280)={0x0, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x200, 0x0, 0x0, 0x0, 0xe8, &(0x7f0000000240)='veth0\x00', 0xfffffffffffffffe, 0x4}) mq_notify(r2, &(0x7f0000000200)={0x0, 0x1a, 0x1, @tid=r3}) 07:10:36 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x0, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 323.906812] binder: 11833:11834 transaction failed 29189/-22, size 24-0 line 2896 [ 323.942233] binder: undelivered TRANSACTION_ERROR: 29189 07:10:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 324.152921] binder: 11846:11847 unknown command 536871040 [ 324.158707] binder: 11846:11847 ioctl c0306201 20000440 returned -22 07:10:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x200, 0x800000002009) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000180)={{0x984a, 0x100}, 'port0\x00', 0xac, 0x80800, 0x80000001, 0x401, 0x6, 0x1, 0x10001, 0x0, 0x3, 0x1ff}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x20123, 0x2}) open_by_handle_at(r0, &(0x7f0000000040)={0xdf, 0x73, "2b7f3db151b89c5ce4b607145d337cbafd84c229ce265844bbbfd287fbce38ec007c9fd3ef7328ed2b8856b35bf63b3c99b5345a3944380538de5e079d183ab38e9577cd1816b95cdf29d4aabcba3bd01969fa2aa7d8e3e95b1ea62756c3755db4c5376cc116b291addae07dc388769efc1f861e3ea5592e8d08aca567d6a00dd7cf87782375eb0884409c42e9fa98c7b435277d6546b8d127284c985104c330a4dda7b774cc6bfcdaea27d1a1e526e4da862c406fc1725b437ccb98926d2f82bce3bde796599ee129b2be031ddbd045d5a7770c619b03"}, 0x20000) 07:10:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 324.403074] binder: 11850:11851 transaction failed 29189/-22, size 24-0 line 2896 07:10:37 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 324.454056] binder: undelivered TRANSACTION_ERROR: 29189 [ 324.460460] vhci_hcd: ClearPortFeature: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 324.504487] binder: 11855:11856 unknown command 536871040 [ 324.510193] binder: 11855:11856 ioctl c0306201 20000440 returned -22 [ 324.523479] vhci_hcd: ClearPortFeature: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub 07:10:37 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x100, 0x0) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000200)={0x4}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x7, 0x2}) 07:10:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:37 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x200, 0x800000002009) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000180)={{0x984a, 0x100}, 'port0\x00', 0xac, 0x80800, 0x80000001, 0x401, 0x6, 0x1, 0x10001, 0x0, 0x3, 0x1ff}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x20123, 0x2}) open_by_handle_at(r0, &(0x7f0000000040)={0xdf, 0x73, "2b7f3db151b89c5ce4b607145d337cbafd84c229ce265844bbbfd287fbce38ec007c9fd3ef7328ed2b8856b35bf63b3c99b5345a3944380538de5e079d183ab38e9577cd1816b95cdf29d4aabcba3bd01969fa2aa7d8e3e95b1ea62756c3755db4c5376cc116b291addae07dc388769efc1f861e3ea5592e8d08aca567d6a00dd7cf87782375eb0884409c42e9fa98c7b435277d6546b8d127284c985104c330a4dda7b774cc6bfcdaea27d1a1e526e4da862c406fc1725b437ccb98926d2f82bce3bde796599ee129b2be031ddbd045d5a7770c619b03"}, 0x20000) 07:10:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 324.758931] binder: 11863:11864 transaction failed 29189/-22, size 24-0 line 2896 [ 324.834966] binder: undelivered TRANSACTION_ERROR: 29189 [ 324.874506] binder: 11868:11869 unknown command 536871040 07:10:37 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) 07:10:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 324.880239] binder: 11868:11869 ioctl c0306201 20000440 returned -22 [ 324.890786] vhci_hcd: ClearPortFeature: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub 07:10:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604808000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:38 executing program 3: pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_setup(0x40, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f0000000180)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f00000000c0)="319f540997ece64999c73fec5d84f0354e4c79123fdd8834bf9e7da5b1c01a392ca09717dcc39ba34161c95210f04e25bfa61b2dfe11727a976e86d9", 0x3c, 0x6, 0x0, 0x2, r1}]) io_setup(0x7, &(0x7f0000000000)=0x0) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000587000)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f000096f000)="060063efff7f00009d", 0x9}]) [ 325.087044] binder: 11876:11877 transaction failed 29189/-22, size 24-8 line 2896 07:10:38 executing program 4: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000000)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r0, &(0x7f00000005c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000002a00)=""/214, 0xd6, 0x0, &(0x7f0000002b00)=@pppol2tpv3, 0x80) recvfrom(r0, &(0x7f0000000800)=""/4096, 0x1000, 0x0, &(0x7f0000000380)=@in={0x2, 0x0, @loopback}, 0x80) recvmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)=""/94, 0x5e}, {&(0x7f00000000c0)=""/25, 0x19}, {&(0x7f0000000100)=""/168, 0xa8}, {&(0x7f00000001c0)=""/59, 0x3b}], 0x4, &(0x7f0000000240)=""/249, 0xf9}, 0x12000) [ 325.186344] binder: 11881:11883 unknown command 536871040 [ 325.192221] binder: 11881:11883 ioctl c0306201 20000440 returned -22 [ 325.202809] binder: undelivered TRANSACTION_ERROR: 29189 07:10:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:38 executing program 2: openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, 0xffffffffffffffff, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b760efb6cd990c4f1a08e53146ffd8dc252ff160ab885aed0675b824f1ab05db06fe841a716354fafb8649709b14a2fcd63de87efc8a3f49115cb7756604b72a6b0e0a90889241c86ef", 0x92}]) [ 325.515081] binder: 11890:11891 transaction failed 29189/-22, size 24-8 line 2896 07:10:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000002c0)={0x4, 0x3, 0x62, 0x8d, 0x230}) r2 = gettid() recvmsg(r0, &(0x7f0000000280)={&(0x7f0000000100)=@caif=@dbg, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)=""/118, 0x76}, {&(0x7f0000000200)=""/127, 0x7f}], 0x2}, 0x101) process_vm_writev(r2, &(0x7f00000000c0)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000000480)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) 07:10:38 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = creat(&(0x7f0000226000)='./file0\x00', 0x0) dup2(r1, r0) fsetxattr(r0, &(0x7f0000000040)=@random={'security.', 'vboxnet1/system{:security\x00'}, &(0x7f0000000000)='ppp1\\self*+\x00', 0xc, 0x3) [ 325.560379] binder: 11892:11896 unknown command 536871040 [ 325.566258] binder: 11892:11896 ioctl c0306201 20000440 returned -22 [ 325.597940] binder: undelivered TRANSACTION_ERROR: 29189 07:10:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:38 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, 0x0}]) 07:10:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf32(r2, &(0x7f0000000340)=ANY=[], 0xff0e) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000000)) close(r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x800000100000001, 0x4) connect$inet6(r3, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x355) syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0xc5, 0x200080) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x4) splice(r1, 0x0, r2, 0x0, 0x100000000, 0x0) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) [ 326.001761] binder: 11913:11914 unknown command 536871040 [ 326.007612] binder: 11913:11914 ioctl c0306201 20000440 returned -22 [ 326.022207] binder: 11908:11911 transaction failed 29189/-22, size 24-8 line 2896 [ 326.036895] binder: undelivered TRANSACTION_ERROR: 29189 07:10:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x31, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000960480800000"]], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 326.254159] binder: 11921:11923 unknown command 536871040 [ 326.259952] binder: 11921:11923 ioctl c0306201 20000440 returned -22 [ 326.277603] binder: 11920:11924 transaction failed 29189/-22, size 24-8 line 2896 07:10:39 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, 0x0}]) 07:10:39 executing program 3: setxattr$trusted_overlay_nlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'L+', 0x3f}, 0x28, 0x3) r0 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x636, 0x1ffe) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000000)) ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0xffffffffffffffff, 0x3, 0xff}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000100)={0x0, @speck128}) write$UHID_DESTROY(r0, &(0x7f0000000200), 0x4) syncfs(r0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0x0, 0x2302, 0x0, [0xfffffffe]}) socket$key(0xf, 0x3, 0x2) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rfkill\x00', 0x400000, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000002c0)=0x5, 0x4) 07:10:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) [ 326.318732] binder: undelivered TRANSACTION_ERROR: 29189 [ 326.332930] net_ratelimit: 24 callbacks suppressed [ 326.332951] protocol 88fb is buggy, dev hsr_slave_0 [ 326.343722] protocol 88fb is buggy, dev hsr_slave_1 07:10:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x31, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 326.496850] binder: 11927:11928 unknown command 536871040 [ 326.502735] binder: 11927:11928 ioctl c0306201 20000440 returned -22 [ 326.652944] protocol 88fb is buggy, dev hsr_slave_0 [ 326.658790] protocol 88fb is buggy, dev hsr_slave_1 [ 326.818886] protocol 88fb is buggy, dev hsr_slave_0 [ 326.824791] protocol 88fb is buggy, dev hsr_slave_1 07:10:39 executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000002280)=[{&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000001fc0)=""/227, 0xe3}, {&(0x7f0000003800)=""/4096, 0x1000}, {&(0x7f0000000000)=""/55, 0x37}, {&(0x7f00000020c0)=""/163, 0xa3}], 0x5, &(0x7f0000004800)=""/4096, 0x1000}, 0x100) r1 = socket(0x10, 0x803, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000740)=""/29, 0x1d}], 0x1}}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$cec(&(0x7f0000000e80)='/dev/cec#\x00', 0x3, 0x2) ioctl$VIDIOC_DBG_G_CHIP_INFO(r3, 0xc0c85666, &(0x7f0000002300)={{0x2, @name="c1f6e7bb7ac80fa03ed8705c6c6cc4aa6613d47e8f92e2563a08697cfa66b24a"}, "02d835ba012c6b77dcfada9f48a2583d7062d8b7a998587ac981116e7aa28236", 0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000002180)=""/223, 0xdf}], 0x1}, 0x0) connect$l2tp(r1, &(0x7f0000000280)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x2, 0x1, 0x3, 0x1}}, 0x41d) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000a00)=""/224, 0xe0}], 0x1, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f00000006c0)=@hci, 0x80, 0x0, 0x0, &(0x7f00000024c0)=""/129, 0x81}, 0x0) process_vm_writev(0x0, &(0x7f0000000b80)=[{&(0x7f00000007c0)=""/186, 0xba}, {&(0x7f0000000900)=""/124, 0x7c}], 0x2, 0x0, 0x0, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0xbf, 0x0, 0x0, 0x0) r5 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0xfff, 0x4a8000) ioctl$TUNSETSTEERINGEBPF(r5, 0x800454e0, &(0x7f0000000180)=r4) process_vm_writev(0x0, &(0x7f0000000c80)=[{&(0x7f0000000b00)=""/39, 0x27}, {&(0x7f0000000bc0)=""/139, 0x8b}], 0x2, &(0x7f0000000e40)=[{&(0x7f0000000cc0)=""/243, 0xf3}, {&(0x7f0000000dc0)=""/51, 0x33}, {&(0x7f0000000e00)=""/6, 0x6}], 0x3, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f00000000c0)=""/85, 0xb}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x6c}, {&(0x7f0000000480)=""/60, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x40d}, {&(0x7f0000000340)=""/22, 0x16}], 0x161, &(0x7f0000000600)=""/191, 0xbf}}], 0x40000000000020a, 0x0, &(0x7f0000003700)={0x77359400}) 07:10:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:39 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, 0x0}]) 07:10:39 executing program 3: gettid() timer_create(0xd, 0x0, &(0x7f0000000040)) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000140)={0x7fffffff, 0x8, 0x0, 0x80000000}) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x87, @multicast1, 0x4e22, 0x1, 'lblc\x13\x00', 0x9, 0x2, 0x3c}, 0x21) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000200)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000300)={r1, &(0x7f0000000240)=""/136}) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000180)=0x5, 0x4) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x77359400}}, &(0x7f00000001c0)) 07:10:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 327.034262] binder: 11945:11947 unknown command 536871040 [ 327.039978] binder: 11945:11947 ioctl c0306201 20000440 returned -22 07:10:40 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='loginuid\x00') write$9p(r0, &(0x7f0000000140)='9', 0x1) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000180)={{0x9}, 'port1\x00', 0x82, 0x1024, 0x14b, 0x200, 0x10001, 0x400, 0x9, 0x0, 0x2, 0x1}) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r0, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x8c, r1, 0xc20, 0x70bd29, 0x25dfdbfe, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1f}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr="701d580b588143f9f7e2bcaacd530c1c"}, @SEG6_ATTR_DST={0x14, 0x1, @local}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x2}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x80000001, 0x8, 0x3, 0x0, 0x2e933d4f]}, @SEG6_ATTR_SECRET={0x10, 0x4, [0xb31, 0x4d10, 0x7]}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20048000}, 0x4000000) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000000)) 07:10:40 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) 07:10:40 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000001c0)=@nat={'nat\x00', 0x1b, 0x5, 0x620, 0x0, 0x0, 0x138, 0x0, 0x0, 0x550, 0x550, 0x550, 0x550, 0x550, 0x5, &(0x7f0000000000), {[{{@ipv6={@mcast2, @empty, [0xffffffff, 0xffffff00, 0xffffffff, 0xff], [0x0, 0xffffffff, 0xff], 'veth1_to_team\x00', 'rose0\x00', {0xff}, {0xff}, 0x62, 0xfffffffffffffe01, 0x2, 0x28}, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@eui64={0x28, 'eui64\x00'}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x16, @ipv6=@mcast1, @ipv6=@rand_addr="6d5c66f7f65addcac9b87303f1cd2cd1", @port=0x4e22, @gre_key=0x1000}}}, {{@ipv6={@empty, @empty, [0xff, 0xffffffff, 0xff, 0xffffffff], [0xff000000, 0xffffffff, 0x0, 0x364d8b70efe78014], 'veth0_to_hsr\x00', 'veth1_to_hsr\x00', {0xff}, {0xff}, 0x3f, 0xfff, 0x7, 0x20}, 0x0, 0x128, 0x170, 0x0, {}, [@common=@icmp6={0x28, 'icmp6\x00'}, @common=@unspec=@devgroup={0x38, 'devgroup\x00', 0x0, {0x9, 0x9, 0x100000001, 0x6, 0x1000}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x14, @ipv4=@rand_addr=0x7, @ipv4=@remote, @port=0x4e23, @port=0x4e24}}}, {{@uncond, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x0, 0x89}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0xa, @ipv4=@local, @ipv6=@dev={0xfe, 0x80, [], 0x15}, @gre_key=0x1ff, @port=0x4e22}}}, {{@ipv6={@loopback, @initdev={0xfe, 0x88, [], 0x1, 0x0}, [0xffffffff, 0xff000000, 0xffffffff, 0xff000000], [0xffffffff, 0x0, 0xffffff00, 0xff000000], 'ipddp0\x00', 'bcsh0\x00', {}, {0xff}, 0x0, 0x4, 0x7, 0x20}, 0x0, 0x128, 0x170, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x4d5, 0x4d3, 0xbcca, 0x5, 0x1}}, @common=@frag={0x30, 'frag\x00', 0x0, {0x0, 0x8001, 0x5, 0x2, 0x2}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0xa, @ipv4=@local, @ipv4=@multicast2, @port=0x4e23, @gre_key=0x40}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680) r1 = socket$inet6(0xa, 0x3, 0xfc) socket$inet6(0xa, 0x4, 0x9f6) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0000000000000}}, 0x1c) 07:10:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) [ 327.302898] protocol 88fb is buggy, dev hsr_slave_0 [ 327.308924] protocol 88fb is buggy, dev hsr_slave_1 [ 327.373075] protocol 88fb is buggy, dev hsr_slave_0 [ 327.378989] protocol 88fb is buggy, dev hsr_slave_1 07:10:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:40 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl(r0, 0xffffffffbfffbfc8, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x5, 0x30, 0x7fffffff}, &(0x7f0000000080)=0x18) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e21, 0x80, @empty, 0x7}}}, &(0x7f0000000180)=0x84) [ 327.548384] binder: 11965:11970 unknown command 536871040 [ 327.554211] binder: 11965:11970 ioctl c0306201 20000440 returned -22 07:10:40 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) 07:10:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x28, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:40 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3-generic\x00'}, 0xb) r1 = accept4(r0, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-control\x00', 0x80, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x7, 0x20000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3ff) r3 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x10001, 0x0) ioctl$RTC_ALM_READ(r3, 0x80247008, &(0x7f0000000180)) r4 = accept$packet(r1, &(0x7f0000001980)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r0, 0xc0086421, &(0x7f0000000100)={r5, 0x3}) mq_getsetattr(r4, &(0x7f0000000040)={0x400806, 0xffffffff, 0x6, 0x3ff, 0x2, 0x5, 0x3f, 0x401}, &(0x7f0000000080)) 07:10:40 executing program 0 (fault-call:1 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x1, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x80000, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f00000000c0)=r2) setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000002000ff0a000000000000000000000010"], 0x14}}, 0x0) 07:10:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) [ 327.975251] FAULT_INJECTION: forcing a failure. [ 327.975251] name failslab, interval 1, probability 0, space 0, times 1 [ 327.986704] CPU: 0 PID: 11985 Comm: syz-executor.0 Not tainted 5.0.0+ #11 [ 327.993676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 328.003123] Call Trace: [ 328.005835] dump_stack+0x173/0x1d0 [ 328.009540] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 328.014787] should_fail+0xa19/0xb20 [ 328.018586] __should_failslab+0x278/0x2a0 07:10:41 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) [ 328.022894] should_failslab+0x29/0x70 [ 328.026865] kmem_cache_alloc_trace+0x125/0xb40 [ 328.031605] ? binder_get_thread+0x406/0xf60 [ 328.036084] binder_get_thread+0x406/0xf60 [ 328.040435] ? binder_poll+0xbd0/0xbd0 [ 328.044383] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 328.049627] ? binder_poll+0xbd0/0xbd0 [ 328.053569] binder_ioctl+0x56d/0x2d20 [ 328.057518] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 328.063756] ? binder_poll+0xbd0/0xbd0 [ 328.067726] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 328.073003] ? binder_poll+0xbd0/0xbd0 [ 328.076949] do_vfs_ioctl+0xebd/0x2bf0 [ 328.080903] ? security_file_ioctl+0x92/0x200 [ 328.085470] __se_sys_ioctl+0x1da/0x270 [ 328.089517] __x64_sys_ioctl+0x4a/0x70 [ 328.093461] do_syscall_64+0xbc/0xf0 [ 328.097252] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 328.102507] RIP: 0033:0x457f29 [ 328.105750] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 328.113779] binder_transaction: 4 callbacks suppressed [ 328.113813] binder: 11988:11989 transaction failed 29189/-22, size 24-0 line 2896 [ 328.124684] RSP: 002b:00007f84237bec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 328.124731] RAX: ffffffffffffffda RBX: 00007f84237bec90 RCX: 0000000000457f29 [ 328.124759] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 328.124785] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 328.124813] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f84237bf6d4 [ 328.124838] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 328.129639] binder: 11984:11985 ioctl c0306201 20000440 returned -12 [ 328.190286] binder_release_work: 4 callbacks suppressed [ 328.190302] binder: undelivered TRANSACTION_ERROR: 29189 07:10:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:41 executing program 4: r0 = socket$kcm(0x10, 0x800000000002, 0x0) getpeername(r0, &(0x7f0000000200)=@caif, &(0x7f0000000080)=0x80) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="2e0000001a008100a00f80ecdb4cb904024865160b000000d4126efb120003000800da1b40d819a9ffe200000000", 0x2e}], 0x1}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x8000, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000180)={0x20, @tick=0xffff, 0x7, {0x1, 0x1}, 0x8, 0x1, 0xfff}) 07:10:41 executing program 3: r0 = socket$inet6(0xa, 0x100000080003, 0x800000000000002) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x84000200}, 0xc) r2 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) dup3(r3, r2, 0x0) 07:10:41 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c5913870950bd6c6c76c916c5e191aefd9ad00914e0993719d5e8e2ca747a10b418359fe852cf551b", 0x49}]) [ 328.564572] binder: 12004:12007 transaction failed 29189/-22, size 24-0 line 2896 [ 328.582126] netlink: 'syz-executor.4': attribute type 3 has an invalid length. [ 328.591406] binder: undelivered TRANSACTION_ERROR: 29189 [ 328.632701] netlink: 'syz-executor.4': attribute type 3 has an invalid length. 07:10:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:41 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) r2 = socket$inet(0x2, 0x80005, 0xfa4) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000040)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000000), r1, 0x0, 0x2, 0x400000}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 07:10:41 executing program 4: clone(0x2102005ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') exit(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000380)={0x0}, &(0x7f00000003c0)=0xc) capset(&(0x7f0000000240)={0x20071026, r1}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4}) getdents(r0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xe0, r2, 0x302, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fff}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x800}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x400}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfd9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfc99}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xc6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffffffffffff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x5c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xea}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x20000001}, 0x40) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000002c0)=0x0) r4 = semget(0x3, 0x6, 0x411) semctl$SEM_INFO(r4, 0x1, 0x13, &(0x7f0000000400)=""/4096) capset(&(0x7f0000000300)={0x20080522, r3}, &(0x7f0000000340)={0x5, 0x81, 0x5, 0xa64d, 0x4, 0x1ff}) socket$rxrpc(0x21, 0x2, 0x200000000a) 07:10:41 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) [ 328.937282] binder: 12016:12021 transaction failed 29189/-22, size 24-0 line 2896 [ 328.964490] capability: warning: `syz-executor.4' uses deprecated v2 capabilities in a way that may be insecure [ 328.989597] binder: undelivered TRANSACTION_ERROR: 29189 07:10:42 executing program 0 (fault-call:1 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:42 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x82000, 0x0) setsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000180)="257955e48f820930aa37b531b9f78f841cc831175e08d99496ac76a4c9b2baf20e04732d03d70fc9c6a1cb6d86d3280c034e2415f3b9653d361b0619412456239c9b386bf58ff275c2f3177b0be6e850cfed09b93fb639820b0d2c21ed1e460ea8350bd75f20b44b474d68d9d3071caa7b4a40998028907c632b0ea7e3504e5bf165a44af773124d41ee03cb9533e20bfc14a474ec436b5caf9ffde61446e53a6449f959865f3d3342e46d5e37e18ef5a6c39cba694047cbe559f5ed8bcbf7cbc405b021fc66043da53509a6252cbd53c458935e9b", 0xd5) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000001300)={{0x2, 0x4e22, @remote}, {0x306, @local}, 0x44, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'ip6gretap0\x00'}) r1 = socket(0xa, 0x2, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000001380), &(0x7f00000013c0)=0x4) getsockopt$sock_cred(r0, 0x1, 0x30, &(0x7f0000000100)={0x0}, &(0x7f0000000040)=0xc) open(&(0x7f0000001400)='./file0\x00', 0x0, 0x41) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x81}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYBLOB="0010000009d52ca0b3f15e588e081552cdfb5dca1ff3682a1e41be59bf4ded77d82f1e49d75807b4c81eb8f7ca3be123f65ba6d743cffba02fe7d04bdd2d2c3d87487a126b5c0ddc76c2e4b8d6da3f7e588eecf9eefa6f8967f9e4d4c5ee0a91eafbbea150c48ef4dca9bd4d472ac1084dd6f6960d1f3bc80a32e07486fbad918b581bce7c7310badceb885d01a38719cdcf446ba8e4fdb2dcae3211a16ba7ff382ee0b95c77c56723e66fa9b2dc4a6def92065cf30bcc9ab2a6ab803b06789fe4208faffbe2c699f71a026b5b7547a10d9ef8d32738b519a2241631748b9adc17df0e3eb6f9d1450c07153d475f8d1592cf0cb4243ef449e70948a8865d902854d2ba1d22b49615506686c5e4d933b1e1b1f42c7ec709d50cdf5efb1d5c5a8b32aa9d30a48606728489102545f3eb1fdab7679d66bcd21fe4e3fc7f6aa0605a78dbeb28e07479335660a0c7db624af46f9fa782eb00f2b9531b8c9672c8e943f18591c408b8c11154d580b8fdd2f259b500ef77078efba9fbf5ebe1a36bc75c40b9cb858983e22ee0863ec65dd7cb9b9b4498d208fe7f1de6fed9a7a30f4bbd24a52f6520f42b4a1bb5823a2e4be7f140d2ae0849d8dbf075cacac0f80dceaf11398a7a6e404cba9e7d3cde6346028d43590dd21a58926697dd2e495096da909b662457115b7b9a87005bf8bf69315e78d1484e8581df2b3bfa92e034132393c6b4cb73b861e329538d2f7565d921e8bbb36dc133f8b451d7cde630fcf2be803f478f4d55993a6a3c5d72bc8441196eb24637961e7356abaca9215c82a4e298f9cdec67837a6b7a3692d3b46ca21a21d6e7ccd5ac81b258da29ea6517ec2b5fb48373b05818a0a6abb2741a9f881bb63f4e50b0b771e2e052132f4005ea4aca88d449c6d00f42c3c7b3ecb51d848ebeb7e6900f5485231216b0d21bf4891452e41656042f15dbf6dfcbb6af82e38da34b119e1d5f8f7e9344ff8a482938dcd1edfe74ffcdd8cdb79a321811eab9151c8607cf979aaa0956ed7ff2c2da11d88ee55f2889462b136f511f3a2fecd8b0a760e0d2cd3b0e0e5748b912fd6366696a8c588ba5c54ae80311aaa344bd7e811226cd11bf7e84fc95d0ff0e6a7cde7806094a6269a3fa91ab6bda3842a54394cc1e371ab7860bb2dd8e528ee6471f1d314dc184ed90efb962b2c1e769bb10ba7568068110a678c353847e3a5911fdca6ff39104ef89429602bf60efce3f4b9e0c11a9aff27762edad8509ad9177f9134d60dc7ef437bee3666962387533f10a2482f071af82a22e27a6c43257557edf0799a20f7184ceb87a72b778ad7d3e7e83f28c99420421cf2e116b6228776b267f29ddd5a7d521a0d268c5b8871a1b9192d2dc757b8dc881c8ac8514bb7db21556d5518d591a7dd9e9dd2b454f99a5ac73d27d323088c648fa6d2ac7de3f3795d44d8f45f2c267592a0dcbf440484b58a93c3a61d57ea13b5ecedc6a9c528b2e934bb04780ffcb3f9b130cde72b07f6bbc60171d7dc1366028899a2389d880d43033438f2b1201a53adeea4b4e50797d96039610096f701af45d44a21c7ddfa3812a33793a7289a116e1b3f4a03332e58622615237e73e94290bf8c531d29167c69498739d688d6990108abfbb19168a03f26e58f529ee1c64ba7a789ff9709fb6ef6677bcf2362692a45c1d909aa99e3207663cf15ba5c77ae0858602b1932166cd798d8d18b701f3e59705bd7264e51a661ba2458ad08c497c993b32400b71cc3d6660e1de3e8fef99af463ad9aef8918a2981614664bc28c524da49c1cddbe0e6ebada58140fa9d2a97131d78251d46a8b03a2ead4b58d591e6ed555568a8b49a1b47e22a09222c1a05cfb883880d511c88a164a8d4a5b147c4ca1062882734100511cb3a2158eef4f0e7afb5b9e309ee8e3bd65457732c9f01895f9bfef1c94e3bf2f8be6f1f7215f01d707fac39efd185caf63178eaff4809e8372e56caea156f577d113e8f5b7c99df0c51f0c2b5871885048c21f01b52f8f47bcbd48bf209737ffe6ded41a0e3f5d48a9dc4e09347f35601ff8939e6f3932b5cdb38b5b0dcb758b45448534d838e17fdfbc4e181424c6ec54cfc1e6a551e0c39af7c89680ad8cb24e8b9f7330daff091b01f130b6f4dd7e4af97b802a6115dc4785732ea1d236c86831592cd93284d51b4e84c05bdbb9382c622126363e21f2e380ab8ef221e2cc7f72f14055ba6a16b086abe7d062875625f03f2ff576055695d30fcdfcf4eb9292af0ce13dc0ea30947f75d75c455f7d332934c66bae83030fa0e6320445063ba778fb641080a9ddbebca913d7995bbf2c3fd0a337ef462cdefea689906ee028b2c92a0739a6b93c1b70286fd2da59b6a7eb7786d46c7e83086ce86c54c9822f574a7154d60f415715a6f55b52682adf2880f042253d79507bd834a03f59a2b3e4093f7098d857eec5aa6150950d3bde36721725e4649bfe98e638a751ab6e9d653b58c2ff514da264f39807bd762cdf513041eb2ad864eea0250d50272e709ca1bd62a5c5ec3a1f76d178a39505a14c72b4a8f73531a2afee5d54e1a7f4b49ac3ac715f8fa68a091931e241f0bc463b7988378919e96d8e1767a37fce3660954a0eef28caf9e9a2e1756c1860851afff8de6199438b65765d623d8446171fb79132d3176fdcd05a85517540bd17f7e1106cf654727f660f243937f2c59c178e5fbe52a24394eace556fc3c8422a853aa60d244e838647bf54adf3796023e70d58cd7a66c5d2d769de969d87554876e774de7d3b54ee954b0704c39a4f1187b6c61a8811a13714715b3f6721b88bf905db62b933f1275bcac4224902b78a851ce22f77deff8265611da5118128ea0ba76f743d1de27e98fa5fbdb2c89ef57603ae354a501a78210ebafe2e41df6c8e9085354bd1def89207d2f23c766f1a90e690f7f9813016a1726c2c6579167ed1095a858326a1707a14f0e1c872ef7d6e94c708fb686408f2889018a85a749bb4bb9eb59f0999e0c6313864940dea974d7321520b4adbc85080c4d23289600f4f4c19b269094591cfc3eb20e067629fd4675401ad5c0eec961685d02118555cf23d7e8eee582848eb70a1553db0bd3dbd17d9b2ee620f7db6ec3eda854fcecfa11a369d83d60558e5d71ab4d891dc5b742e5060329dcbfebc53f7a028ab23aac0b3e6a6cdb000e753f36ff1c8f790a8a4bbdef579e2daba53673afc821bed01413cf869a64c3b6e056dcdf611764abb0952f1d0d9132d33d5bea145190520c9d49e94ae777f9d93d89ce6ef9e5d9b72106299b4a5e4aa36e767a24452d183aae8d768a82dddf5cc154a6894d3b714750c3634b3488277ff12ef1898e985e91c4ccfc508e42640d8f7a2ad9d78df78e5385679015b54f5d4003d12a10839138be3c037da59407c7e783ede19c3da8e249a02e89b01e8afdfaae8f5cd72d113b8db4def9b9ac7357c6abd8e295fef5ec5f23c4c6db7b94201fbdce60d7dae45c82db5f64b4c31ed74f4044e7c6ecb56de77324d09b4f3b2e5a36b38800585b9c44c948b56c4b50d21fde08d3fa2fe474b29207249491144eba5b96333ba0b2215d35ac8f3340d792279b8153e75f24fc41e99fa72c07c2f02d7e4045b8d66bec1927e216f1c2e01b27edcc364df5826b8709aa91cb018a6a21523dc4e1156e99477ebd542f8a71c05f1bb89eb571a6c08b7daf6d0871d605b2d22ef8a260c91102c7baa71c13b0110f9629ccb51888b5f2ffaf51f690e9e61e7b290dbef483bf775bd9bc4e33a5d97dbd32f4f277743b47274c8216b89671df0d46b4382da495f3de4887bc1b36929f4abcace30525e825d9256eaf40ec037f4fac63683c48b038190e1db67419a083324318a1b5835934b5f08019617fa3e05b8e68105cecaa62a90e4b6030a9572a98e9c18f768258e3b909638a2c391934883b0be47f84b398897af6091615a305c471e90e47738df3dbd0da755438b200eb8829a7e34b1f0ee45378e58c5d514e9e2a8dcfd59c232ffe2ee53fcd81cce16768cec0002f2e76c673176ccb0fffaa57515a545a1ff8e5056e15f35c3617f7d3ca81c07341bad35b034ad2cb28b65b8fb28f0f070b7aa631e4c7394ee7ed6df9ab7a5d072525fedb4996c8f0692670ecea23f297aba5c6a1f7241a99d6134ff7e178210ab223c8beb2ce60f51558c6869694f0a975f558562a7d0fe39b27c090d34a444297eab5222ab3b0134d7b7daa2983f05fcb9b369fa924d306d15aa4555d549b33ee42953833951520296727ce3d2aa5b83e354a9032bf69eb2da306baf5c0efa0b2100dc1b3c30ffe8400c50c6bd10ad96be3d65c4f56719e373561d32548c3f3a4f6695340859d942b88f345d24e155d51329232b4eec820bbb78701272ae52a72e0ec77b49b3090a0a1aae93b62fea475e1c17eeb08a88119c95b408a8dfa067c7d2d9194a155caef5db27826b2e0e46f83a373022f5295bc56359bd46a667af425a28848d68a196a0eda3930f970df72ad2fa96c1598535b8a78adb1cb386031f32483f526af8c59362e089596e9c7ca3da0782bba4037fbc82bf47e39f5b9bb77bc12fe4691bff5aabeea5d8962ccf789e9647421449af96bf6a7b7e778741f43f7105bf85778df4e17d7494fcc106e366ae1bb4a4eab9208756e8275584a4d31149318eeda9f7dccedc266d9c61489d7ea32306203fc010450716fd30d528aa3fce57906ca8b3fbb67a4ecc7fe474cd8ac5ad359e71d370be381ade3aa0107b3dba17d151e7178e65071c3b6a06883559af5da3ec86aaad42ae6f520e282580d6a3c74f51fbe241f8ecc2999d56e946f58fe6c0af58e7def493aa1ce952c037e67f7ebe7bcafe60bf55f29a440029d2323d16d88a30ce64b764308f1fa9f0ee973a3c0d9e1a75305e2ca070626585916f89299e983e5a35109f98a560a2b819e98a3c2fd8668ed5757dd848d40013461a9a1da389578ac62a46a65ba9188f2f66433fb3c11aec06958e0caaa7f231ae5e4ef3476912d8c2f46f94f6b597e3337f41db01b406303588e0b03721fcd3fa5883e1027d275c73e5dc10cab1b5dfe3efa15e6e17651777fae79f56032d9eec142a6094c0c9be5e310c4f987faec8ae210e0f0e87a10855fd921ac539be93752440e60e7004c147ea04631b257537991174db8ea3c4c6a6fe095b7fffa4d662f6aba92e59357f385f3b414ed8c7965fec299830a9e201670351b89b72be75f96b11ce5b30877676e0c1c890ecfb2e2899bd86c9e1844ad9135b2a606967081cf675eab695afb71ae456d58020da2d587a78d33eeb4724355c930ab6b3a7aae25119bd3159343be23f32c48ea073426d6eaf17764520087879bd464d59a043521a0d14993906c38391709ac030bb0173e69da15e302eb63bb38db90393224bbd4af20d8f0523b2c2f4d0c45f92cda45fcb88785a1e7c7208528ba4a6f7713e6e8a36e372b7b6fbd6e2765616dd4521ce5d19e9f61c5eceafcba5a13c5986923f4c3cb2a3e940d18facd5c96049de91a4ce55cfd3b877d180240061ff8c7e12a63c448afbce63e50bbe15069c55284f16314e4c05c70d2125a2adf7b1234d951115896f26a27d62cfaf2e2ff34b8339a3a372f310425805db8dfd0d32a7753087d7f75163409c218d7782bd28889ee7deb0bdb53cb277f1a007a6f072d71a1122e851398297d31628c906bfe41973ef8151cfd838fc4794eb3821cd189eda4584aa758791b70384cfdcba3c55e74a8eda8c561aa00000000000000000000000000000000"], &(0x7f00000012c0)=0x1008) setpgid(0x0, r2) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x3) 07:10:42 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) [ 329.223735] binder: 12034:12038 unknown command 536871040 [ 329.229443] binder: 12034:12038 ioctl c0306201 20000440 returned -22 [ 329.254142] binder: 12035:12036 transaction failed 29189/-22, size 24-0 line 2896 07:10:42 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x8000, 0x0) ppoll(&(0x7f0000000000)=[{r1}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_ifreq(r0, 0x8918, &(0x7f0000000200)={'eql\x00`\x00\xa9[,\x00', @ifru_mtu=0x1}) [ 329.286873] binder: undelivered TRANSACTION_ERROR: 29189 07:10:42 executing program 5: prctl$PR_SET_THP_DISABLE(0x29, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x410000, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f00000000c0)={0x1, 0x0, {0x2, 0x2, 0x52e, 0x7}}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x7) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100)=@int=0x7, 0x4) io_setup(0x2, &(0x7f0000000140)=0x0) io_cancel(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x6, 0x1, r0, &(0x7f0000000180)="e9c57fa100fc14e243206d032a38a008eebeb6ffb285d19caf453d75712dcc373bbddc1ffd8d3b617240", 0x2a, 0x401, 0x0, 0x1, r0}, &(0x7f0000000200)) setsockopt$inet6_udp_int(r0, 0x11, 0x6f, &(0x7f0000000240)=0xfffffffffffff000, 0x4) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000700)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000300)={0x398, r2, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x19c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff0f1}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x731}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x92d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x28c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7a8e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x144, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x57ce155c, @rand_addr="934fc683f1591c078c6eab5d56c0d693"}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'eql\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2a}}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x400, @initdev={0xfe, 0x88, [], 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, [], 0x28}, 0x5}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ip_vti0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x1f, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}}, {0x14, 0x2, @in={0x2, 0x4e20, @broadcast}}}}]}, @TIPC_NLA_LINK={0x90, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff7fffffff}]}]}]}, 0x398}, 0x1, 0x0, 0x0, 0x4004005}, 0x8000) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, &(0x7f0000000740)) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000780)='/dev/amidi#\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000900)={r0, &(0x7f00000007c0)="26c8b9740888d3481cf984862b85231a6cef367c01c5014e50d4357ab6bccec0c02785195b630226193694d59b00b0ce4cd7aea89745b2df74ea1a8d66ef31aad19ffea39619964e3009e28fc739812b6c0ebe4ca2ed7a36f2cee47d7c4a07aa6bb7f9d50e4975dae7954360de150f2143bac6ad86ed2584d288b838611c8d849aea4d9bdf93b17d1c1696e441eaae849f94ce86e5782c43352f0eaef5942ed4ad3fc44b8bbd1a95a883443c8481a2f6e52f232379989f5236d3b001c6c6e3ede4cec78493579be3e8457bc3859121028657da192fd456de618f652803307ed76fb53f", &(0x7f00000008c0)="f0105942b1a0222ef4ca8bbc29222711a54a839f49eccbed8097726371907529204e653b", 0x2}, 0x20) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000940)={0x1, 0xf12, 0x4, 0x80c6, 0x1, [{0x40, 0x10001, 0x4a, 0x0, 0x0, 0x1000}]}) bind(r3, &(0x7f00000009c0)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'authenc(sha256-avx2,xts-camellia-aesni)\x00'}, 0x80) r4 = accept4$tipc(r3, 0x0, &(0x7f0000000a40), 0x80000) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000a80)={0x0, 0xf83}, &(0x7f0000000ac0)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000b00)={r5, 0x249}, 0x8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r3, 0x2288, &(0x7f0000000b80)) ioctl$BLKALIGNOFF(r3, 0x127a, &(0x7f0000000bc0)) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x24, r6, 0x120, 0x70bd28, 0x25dfdbfb, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40) sendto(r0, &(0x7f0000000d40)="a01db61387604bad7a4c0b2119bc0e39934eb7204e165a5f1c2bef431a3401bb62b29d1676f91ed75f7618b975194330126d9a71aa1168dea62a54e10daee3858819ef56676912e37f6fd98da1a4a2316499d0d455550686b3485d73b40c29606715616623186a4c4186b9196d92a7cd2bb1ea6f5af170822cabab98e3229b5d5861aa21db1d459baa3b438ed413fbdfd4a53c8ad21166ccaac808b06510fb1db26c8c258b48ec41b83e1a5efc793d9fc765e7c656969711ac8c140dd4566fc9e702a563493db2e253187c66ddd8c1981ef0d0c738dc42badc1996d97db78db6d258604299195d8d376add144d9167fdc3b2c0e1417cae390d2f868e8072c985ea6f940b36ecc9f6bd3672e35aad5f04b52461f29708024293aa6f2e9ab15b617067feb9e715fa4843ebf374d772cfe5a3a72e619b081a205db65032e84a702291a1d2c374da8f3f4e5c69010f329ff3dfcbcb9079965edc6f3c98fcb4b34aecb403e3bca043d69df817b9eee8dd2c77c5a3041588b024b05db13b2fea79e982b42bce9564b00208c68f77af03801d30fb6fb9d2f5afe1a0ca16c01f69050a579ca381016fede214448a90306fc7cdc4e98b7de8def564aa415da424328189f605b1945314be565387c86e70a7e45efc3f8d2707db2427c7a1c8912c5f97933041d327e07d363b3314e4e76221bcf50f286b7db9fd3000fca9f2d03dbb9e29c402fa411df728bc2d8ece61ef831367fd47d03c86b66ed32b794d06022f17e4ba911b7e282630a16112bfa13996ccb22b097b9efc89f0b27ad7bc5af22a57196b0fa0a7c0615075b5d865514ace2affb1a9eee12a5e96ea86ede52b58477e3f401095de52f0c444d9297a5db1b8c3edde3b6c2431d3faa2f2c9e85bd422e9988f2a63ba7a0ea6888327766ab0492da9fcef4f9d79a7cc8fa9321b71845de706a649ebc5203c0892610fa4a462c40b376ff16d77d7567674955ca1fd453d992734da4af1a0004841a630fb7711b7d94eb5a8f020ee44854183fe336152934242b65deaaf032521bfd202e55765405b7767d57d5ef9f2e303e6fc1d944c731cd9a77bb4900902ea71b83bc450cdb6f83ef129e9c197b48e3a68baa3dc3546f3dd4fffed3386c469502644f6b3e3daf0af03aa62e3b70569eb7e7ba8981ff02383858369be3715e67deae5b4d0a8849255dd1dcf82e93d108982e55ff3d1bd97afea203dfa1716278ca7bd60c98506a683f5647288765af206d78399a9f76314245e4539250c46cd42e6debc5d3247f2ce3b3658c4558329c7e53a77a852fbba503b9dc2121253360cdd059b1c80b6fddae572157b3eb79be5029da8a059150ef8ec72d42a171a2c136dad1690e6226a10edd8de60795125f99f576c2a618aa15c02e17786849e468d081376e265d2b1723d2516bca4b207c18ae9c304c06b4ab3140b577ecee7d4f747708d4e041340e1c232f89d6eff6795b216dfe9824e40ef43a2bd3dd6560be1c13128148419a4ef1cdd27f40eaaeb30f2eed523137b6e20f0d7d14260ed409c0062630bbadbe632abf00123bb6716e227dcb5f18b46ad5657d75eed7911f93d1851464f77e52495f6ba5dc4b086ea5306f5c362f89dea611511e29aafa7fc54199625d340c3153f2dd9e336aefcf8481aa238af878a615ddedcde1926a6f8dfa04b8cc1777dfa6bf9297fec70a93ebdfac331f464fff63deb7b50676b03fb740e7cfb5a591c02ed33589706fd12bd1fdd5608eab3d0bbf93b5092596f20d9a92015c21c748e349d4c527ef02d512eefbf2384fa3f4cd858bc28eb37f9ad4569d12e8d25c8cca2baa482822ed5445b6a53e86dd28b9d3b74bb0d23999eb7410dc6ae8df0a05c9cf59734c2ab815b988ee0f4927aa7c65b5b4d068c2a192f69be33d7463b636ef2d6f66e35cb3543f026991df6af7ed7b48dae60800b26a6d8cf1eeb2d83a884859e804199f6a2074c62f7bb2e7b956bc27494e3ede3881ad61097fda8a73de84dee0b77f499a018927ad0c22f44c464469ac397971b4b9579e22dcf73e1331adf3e7bad5fc85636307bc4ff3e5e7f0f2ce58b362397039835e67b5b8cb7fa0a83eba25d03c7c25e0ad2f8a826f2bd6d4060326d7da34ccb55a3fd9ab33b32a59ef6309315e8dc98e7bfe498be15182edf6f3b0e649044645d0bf55b4005b13d27becad1a42aee949247067acfe73bd7c48e2c79ac9a490158c9176a7954f4f5ae284d9a6e9deac3b1e06532d8ee7b41b89fd60eba474ac8e8a0a156d6f74d5838988164c331dd21f1f4a7f7db06a7ae2107e14ded03b2093b3796266bfbc3beb977c0a7fdef0a8d3c8be5fdd4afd1e973c8403e7f704dade90d9420cfb2943a5bdf51bcd8fc8e744ac8ff6d20bc22ab093ec5ddba5487e0b592dc33cdea1faa97f28ac5ba53826278a1bfe3c1ff28e0703716da9bd8da507448cd0a4fb643a3a4229fe9fbd41deeec3cdb3fbd8454e56c98fc84f8b36ebeb323691d7b67b6d2ac6e3916a32c9f45136f4636493bc593037dd30ead3b8fd578870a705a35921399d898bafbd53a822257cf264fa404a87b12391b38102dea08a1c402d528033dc5f8e7c47faaac0621351f20552c24afeee979dff4ddbdc46dd2f6284f4d7dafde04f155fee79878b8a7c42650164426b0f5c16c9bbcde228ac322341ca4d34a68c689637cc3480e738f2004f8f698ff327585e4419ba74b9b023972ee750c6ede0bfc02e901cbe63bc902279b7779f095a8e5dde6f12bf8327e9f46a9842a158100adfba8ef9878074eb0d3e34bc2d43845520bd1e0fa5b31968cec666984ad7ef179b0d13de026b36c04fb86e521061839068ccc84eef4ff833984e6fb6da2d37710f11e98cb013883e5996240ccfd6d7005d131efc11928403eba177c55a5d27f2a32d60472bf513c8749ced945bef8250fbc52ff6e6f699db35cde4aaf88931d703de2fb6f37bd0149ebf49295449ef7656567cb7601a91ecfd35b87d2c3a61e7d8ec8d076a583516ab43d677b5c1e1a1256e6424bf584ae02052b02546be47bc666968a50706a903df21b587c97d9953f35fec5c4a0d78bf99a59edec47287f0ff3812c5f592c0035126169b7c40db519b74a34cab387dd1fd91ee9cfb189160da80fc4121decd9757b4d50324c1d624e9bfe5bf9d3b09e741bcea6097b4cf8ed4ffbdb6e36e61693619c3753f875be2ff9201eeac933478dd4ae1b1f7de569f5de885bf939bcfff05a4009a677e19855ca46a679819415b7b38482ea63eff735bf24b3513abae723ffb93f5cc6dde859c60bb055e6081e47d6ff127de9e1970e0b916fed5aac44dc71e1322f1b2090a268f051b9225b271ec553ab6542b2d80e099107108971f055180e211bd5407a2d2ac957a6ee2c8dc1c4eacf7a1535b7d40e2b20c56e4d53d552aa30aacf7e1d96ff76c37559112f92121a1f96418fc059bee0aacbe6d5f7ac4ec67d9ddb30a15f03d13ff0cc2b2228845fde1996c9ff0a189ee2ac825b4b0470f0621080a74a83a865ede79ce00e0e9220209a9a13a6c6ca5e47696d62d1a36d1267a63cf0d2dc2eeba2270939208981d7a8a5310372c119faeb042693366e294b270bb525cb47dcd0b4532bb75c4599de6b1f28778e93febade1e80cf44e99afe465622a9420206a01e0f82d047d48a693eecdbb757982a03ecd608530c19cebb21189523e724db8f7f63ecdee5c9c36c4ed503933182c101bc52f2a641c180051fa8d3b2b8aa3ff9532038caafaa6c9464c6ed546bac042e3b16f72bb4d78f9e2f8e723b4574260d9a8f2e0b00b0b39c5ab83eedee5a79fae5fb325a5b1a87a5b0643439f525c18a56ac7504a5cb07d5994043f9ad2f27d447e4741d96d766ecdb3b38b0db55f05aead831315e512f7344cef4fc6db11933b55d512d1e012aea9cb7733052dcc58f23e741f85b6bfc5afeaecebc00c65e5a4afc540a6e32eaeb8e6db3e61d2a0b4dc49f8b04b30f8d121bd994cc327456a0e3d23f052cd892ea11b83c8bc629925ab3b1ce1f445fb84108c2a31b9692fde20e55f59964a970c1bc366299e750b949eeb60a50e0e1c8e9db9efdfe18c6ad3688b920ebce4009cc13c6b69be9fcc8677a3de6085df44502f08298cae778cef34a8ddb20eeaf64acf12aa3d5ae31b7b483221e16738bd6a11b196f0a49500596faf53c73e77191e6cc76d9cf8f574bcab308575a79216d330bf2160d47ffb7c89be01d6559bdd928f06e81bd27d8f97e7b361102de5bc23567f070f085ea81102058258506b1fb601e144c12936c27dda90f6f80c0301b4980de47348911bc6f5b09bc39a4a9327af7d9df6f1b04979e4b17277732f392c9052536b3f035c8eefa47fad70823fff0229c80df4fdbd9438780b24e14bef8b284accbe2529088d9c320149fc2b1721fe744b375f8c57da00a178e1623e6801967ee39d55b004aa44e144940bf0a2ceff590c4c946f5966189b4707d31681f75ec3b3d442fe8b6a685fb0c2af1f8f38c59132cdbcdee18ed02cd5e22f47819a298cce2fb6ed934a48b8c762a304146f8bab03c572e25df85fae7d3213cabdee0bbcf090a525059071da6ae981bfa278ddcdea4cfb786f80ae9d4aacc0fc6523eefddc3ec6a2b0735947262c5d96ef9f1c4d92bb664acf71ca04e642635b94d55185d013a6d0c660dd9dc6aca9b48d6cbadb5173c594a9c131bd10e6104ac7fcbba3bd38c9f43d8df83bf34be4e98df6d053ed51209e190b3c62c785929389744be1798ed91690f8fa1d9aed14f3ea8956af8dc1ebf1720abc105196f0bbf0b71ceb600b33b5720c89c5e21fc480ed10f871bd556ff674e0f43da19fc504d1c48c88a5df73d9c957a34c9ba9d56c353302d28c6036ec2426958541a508aa93afb4ffd2ec36dcad02742f867c2cb653ad5d8fb66c94b2722225a96dd570cf82b2297b8af551edb5c683e1bd2a2624677f1a6716bf3061ab7d34404ae0c8d60fd171075a98c47867a4298c4f4987c7372436893b3721d22e08b58b388d550af10140b34e375066942f111dcc24c98c69f1acbf22c9092b8d71a153036e3ec097be2bec4c25e3b101337f33936681fded5703a3cf9fa6498c1531594c1131911ce465e762e5afc8bf1b00cecb17f0a2498b5580b2a2b59b846b99e11596e026a882973b12c65307c867cb57d3ebe193d39034aad251cb8d3f56be0c4d654f0dbd7d734bdcec58cc85549573eb22120503e3fe5486aacd317e01dfae717cf5c4e76d8dcf80b1894f79c068a6cf4dd02fdc9214002732688eb6bda3fd10e8aa84c7fa1c412d1c2ca96cb7137a3d79c6138e721b25c81f54ab53ce61daf99030b81bb632ce4b69bdcbdc03dce512f9f0581ed572b3c50767a5f737d10f7e7e91195160b104b8e214b52c66b17cedeb81797a8cbc5478c119be6ee3dd8e4fefef776a65ae9d5fc7ee1ebc0f5c0c4c951de139657c1629379e5331bfc0b9e05462e711cc44dfe2863266bcd56c6775a9a82120292208a2c9206f3a791ff7013e638587ab1125a459838c0c61f9509dcf5b7d83636de8bee86b0cc8fa24dc3df436a9809f43e1e39c45f90b2782a158225edd048dd1509cfd8a71c7b1c75d097db5ab794fc567d35fb15e3a681f6a8b8660e04e4e0d0b817ca30b5a25d0ba3dc009c0d6e97d741b6af7da8b4073960ce57997a5b06bd9969d02919a60f4b509f27ea7e81afab0f54bf92e02f71afd74cefc75eb2e98cf3e8255d1e261992e9a2ba493f7d3c5459ffbd414a87b67677b9b34f4b6bee077615da496d", 0x1000, 0x0, &(0x7f0000001d40)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @remote}, 0x0, 0x2, 0x1, 0x2}}, 0x80) io_setup(0x5, &(0x7f0000001dc0)) execve(&(0x7f0000001e00)='.\x00', &(0x7f0000001f40)=[&(0x7f0000001e40)='aead\x00', &(0x7f0000001e80)='\x00', &(0x7f0000001ec0)='broadcast-link\x00', &(0x7f0000001f00)='authenc(sha256-avx2,xts-camellia-aesni)\x00'], &(0x7f0000002200)=[&(0x7f0000001f80)=':/ppp1\x00', &(0x7f0000001fc0)='/dev/vhost-net\x00', &(0x7f0000002000)='syz0\x00', &(0x7f0000002040)='nodevvmnet1\x00', &(0x7f0000002080)='TIPC\x00', &(0x7f00000020c0)='\x00', &(0x7f0000002100)='\x00', &(0x7f0000002140)='\x00', &(0x7f0000002180)='\\+\x00', &(0x7f00000021c0)='\x00']) 07:10:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:42 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, 0x0) 07:10:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="0000960480800000003ddb9e86b29e378752dc4e381eeb522db05a068378e914703c228d18a57a4b9f793cdd487461f6d78cb58a219de4c1aba7e284c0ad66e3dc376cfd3db243472b82c6acf911eab88bb5def463ebbf8606f3f1615e620dacc0185e368a4b100453733dffae2aaef9e90144e2cdf7e1c65365ef4ae02f19f4096b621f4f7c9b6cd5bc44ffc7eb9c49c1aac00944671322586a4da87f2a8a9b59d0f7386e9c77d1fd851a7708d25fbef9293369e5d1b361677f5cf772f7f16dbe9f71827d56f2ccdb6fb6457547f049b4e2"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:42 executing program 4: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c61, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000380)='./bus\x00', 0x141046, 0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x6d0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000100)={0x0, r2}) [ 329.597712] binder: 12051:12054 transaction failed 29189/-22, size 24-0 line 2896 [ 329.670364] binder: undelivered TRANSACTION_ERROR: 29189 07:10:42 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)}]) [ 329.718262] binder: 12057:12061 unknown command 536871296 [ 329.724176] binder: 12057:12061 ioctl c0306201 20000440 returned -22 07:10:42 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./file1\x00', 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r1) 07:10:42 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x6000) 07:10:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x6c00000000000000, &(0x7f00000003c0)}) 07:10:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x1) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101202, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76dbc29b696bc129fc6d4c7aa3457c59138709", 0x25}]) [ 330.079351] binder: 12075:12077 unknown command 536871040 [ 330.085303] binder: 12075:12077 ioctl c0306201 20000440 returned -22 07:10:43 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) dup3(r1, r0, 0x0) [ 330.194022] binder: 12075:12081 unknown command 536871040 [ 330.199730] binder: 12075:12081 ioctl c0306201 20000440 returned -22 [ 330.243343] binder: 12078:12083 transaction failed 29189/-22, size 24-0 line 2896 [ 330.285482] binder: undelivered TRANSACTION_ERROR: 29189 [ 330.609410] IPVS: ftp: loaded support on port[0] = 21 [ 330.706507] chnl_net:caif_netlink_parms(): no params data found [ 330.753311] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.759767] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.767750] device bridge_slave_0 entered promiscuous mode [ 330.776053] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.782651] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.790343] device bridge_slave_1 entered promiscuous mode [ 330.816545] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 330.826900] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 330.850802] team0: Port device team_slave_0 added [ 330.858356] team0: Port device team_slave_1 added [ 330.914972] device hsr_slave_0 entered promiscuous mode [ 330.972518] device hsr_slave_1 entered promiscuous mode [ 331.027905] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.034401] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.041340] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.047967] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.109472] 8021q: adding VLAN 0 to HW filter on device bond0 [ 331.127192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 331.135879] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.144477] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.153364] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 331.170773] 8021q: adding VLAN 0 to HW filter on device team0 [ 331.183182] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 331.191176] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.197715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.211515] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 331.220146] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.226829] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.256118] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 331.266223] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 331.283935] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 331.303446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 331.319116] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 331.331109] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 331.368950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 331.442736] net_ratelimit: 16 callbacks suppressed [ 331.442757] protocol 88fb is buggy, dev hsr_slave_0 [ 331.452929] protocol 88fb is buggy, dev hsr_slave_0 [ 331.453934] protocol 88fb is buggy, dev hsr_slave_1 [ 331.458977] protocol 88fb is buggy, dev hsr_slave_1 [ 331.532803] protocol 88fb is buggy, dev hsr_slave_0 [ 331.538163] protocol 88fb is buggy, dev hsr_slave_1 [ 331.582646] protocol 88fb is buggy, dev hsr_slave_0 [ 331.588025] protocol 88fb is buggy, dev hsr_slave_1 07:10:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) setxattr$security_smack_transmute(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$evdev(&(0x7f0000000340)='/dev/input/event#\x00', 0x1, 0x40001) write$evdev(r2, 0x0, 0xfffffffffffffefe) init_module(&(0x7f0000000580)='TRUE', 0x4, &(0x7f0000000500)='/dev/input/event#\x00') setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[@window={0x3, 0x8000, 0x3}], 0x1) r3 = openat$rtc(0xffffffffffffff9c, 0x0, 0x200000, 0x0) ioctl$RNDZAPENTCNT(r3, 0x5204, &(0x7f0000000380)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, 0x0) ioctl$EVIOCGSW(r3, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x1) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f0000000700)="89b53bb34d9f5b8cb7b64d3c7f12dc113df62bd1a6962eb8d074619d1c94af099eda8abcc352bb136de78c5038536e4a63d2644c0004a09e4c17a65a5224808c8cfb95a70b56e7c30c90f75b6608ae191ddcd84e54e11003179a01a770bdfda48ffc54664814c6a83b0954ad9ec49bdc02ad91304f6597b54a5a0d8a5f9fdc5a425754bf6e025a17d1403dfb261383b7b69b789a2c907776eb73424c62483c9c821cd7f947c470e3cdaa544cd5edc57d233a58550361b8181512fff6d4819a6632e9d95fe5dd3a01") ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f00000008c0)=ANY=[@ANYBLOB="fd0000000000000005000000001200000200000072a4aa0eb4ff0100000500000000000000418df66ee8a2650ac282a757f11400000000000000000004000000000001000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000080900000000000000ff010000000000000007f058ad00000000000000000000008400000000000000000000000000000000020000000000000006000000000000000000000f7200000000000000000000000400000000100000000000000000000009000000000000000000000000000000ffff00000000000000000000100000000000000000080000000000030000000000000300040000000000000800000000000000000000000000000000000000000000008004000000000000000000000000ca78d3835ea0f6562fd7dadb8e667aaa7e72098ba03ff417217aaadd444426818a24981aed2b6921fdd50a8e357d8a2291bbf4accad63583a19f78497eb8a97bdd6dad0acd5b5f941cc392dd66cdf85eb31b7bf3be90db54a6ff2c02f64dc88680526dac370de112dcab8cec282b72bfe7d73dac83c123293b8eb936d67eb34ec5fb45c190cb7d746a271114d0f50ecd0bbd0e6f36151bf938aba559bfd8b0cea9078ebed983bf393e93760bd5d19bdaf6dbf2464acc93000000000000000000000000000000"]) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001500)={'team0\x00'}) sendmsg$nl_route_sched(r3, &(0x7f0000001700)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100400}, 0xc, &(0x7f00000016c0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="0000f2fff3fff1ffffff040008000d00090c6adfe5e0c892c60025ad38908ed98b7402000ceb01007f00050000020008d40008001c0001001f03080005000000000000000200000004000004000000001c00010000063f0a0400000001000000020000001f000000e2d43c149f8c030000001800020002000000ff9e00a8fc5a83acc12d7e04aa255490bdf3bdc353d951fd01001c000100200501040600000002000004100000000104f03b28a0bb0e0f75c8ccc8515d7048e600000500000014000200007401000400500000000900ccee0100000200080000000900000106000600090080001000020009000100020005001f00040010000200030003000000fdff0400c5001c000100000001001200000000000000fdffffff0000000009000000080001007366740e4800020087000000ff7f0000c5011f00f7fffeff0100000080f600000100ffffaa38000005000000ffff00001908060503000000060000000500000003000000030000000104000014dd38ce4ef1c76b60b4d9094fb5f5f2aa9c71d3061e62996e987e7a060aa90a1c1989092041489bdae72059e50510147b9104408e5960e91d8cb2a700d75dc54dfad2d3a39e41453e680a3833562b27bf90155c090f1d59285f643db0c403c8879409d178de21d623769d02c0910f6c77b6212b7fc0be0500448a4718131d0ecd0b004a3d"], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000320000/0x3000)=nil, 0x3000, &(0x7f00000002c0)=""/61) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000400)='vcan0\x00', 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000180), 0x4) faccessat(r3, &(0x7f00000003c0)='./file0\x00', 0x43, 0x200) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @rand_addr=0x8}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r4 = dup2(r0, r0) write$binfmt_elf64(r4, &(0x7f00000005c0)=ANY=[@ANYBLOB="7f454c46099902fe070000000000000002f00006000200c967b095d1b2ebd300c60001000000680000fb0200000000090038000100825d00000500070000002700000001000000000000000000008000000000060000000000000049000000000000000600000000000000008cd1b8c2d49851b3e5746471020000ff07000000000000ffff066c1a07c68354e5a0000000000000a90400000000000008000000000000007ef27773d850af785f56cfb401bb267d98b03ffc85c7db121378c505d46acf4fbbd422ff6fedd476ce187f801884e520ef7f74c361e1b10a5fea3714fb76f951ef020cad7893e40066fc"], 0xee) write$cgroup_type(r4, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 07:10:44 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00\x86o\x9br\xcc&p:4\x96\x1dn\x17B\x00\xbccT\x8c\f2b\xd8\x80\xf8\x19\tq>\x8e\xb4\xc8\x7f\x00\x00\x00cU)\xae\x8f0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cpuset.effective_cpus\x00', 0x0, 0x0) sendfile(r1, r3, 0x0, 0x1) 07:10:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x28, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000"], 0x0, 0x6c00000000000000, 0x0}) 07:10:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40100, 0x0) ioctl$VIDIOC_OVERLAY(r1, 0x4004560e, &(0x7f0000000040)=0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) prctl$PR_SET_FPEXC(0xc, 0x40002) 07:10:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000004d00)='/dev/null\x00', 0x48100, 0x0) r1 = socket(0x2, 0x3, 0xc) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'nas\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcc\x03\xd7\xc2\x9a\')\xbf\x00'}, &(0x7f0000004b40)=0x54) ptrace$getsig(0x4202, 0x0, 0x400040ffff, &(0x7f0000004c80)) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0}, 0x4001) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000002f40)={{0x0, 0x3, 0x0, 0x0, 0x80000000}}) mknod$loop(&(0x7f0000000500)='./file0\x00', 0x2001, 0x1) [ 331.702878] protocol 88fb is buggy, dev hsr_slave_0 [ 331.708599] protocol 88fb is buggy, dev hsr_slave_1 [ 331.784807] binder: 12101:12102 unknown command 536871040 [ 331.790560] binder: 12101:12102 ioctl c0306201 20000440 returned -22 [ 331.811489] binder: 12104:12108 transaction failed 29189/-22, size 24-0 line 2896 [ 331.821335] binder: undelivered TRANSACTION_ERROR: 29189 [ 331.856024] binder: 12101:12102 unknown command 536871040 [ 331.861713] binder: 12101:12102 ioctl c0306201 20000440 returned -22 07:10:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setns(0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x170, 0x0) 07:10:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x28, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000"], 0x0, 0x6c00000000000000, 0x0}) 07:10:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096982f620051"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:45 executing program 3: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000040)=0x1, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget(0xffffffffffffffff, 0x0, 0x100) r1 = socket$pppoe(0x18, 0x1, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x2000000000002, @local, 'bridge0\x00'}}, 0x1e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r2, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f0000000980)=[{0xa0, 0x0, 0x1ff, "f1da3134407c43ffb6bba21089da458c26e81ce9492b199f8f04561af3a7c7e902ca723e2a27fba05c7126b7a9160a73469f9925bd0c11875eac7c9a13bf3d3b2a973124a2116327ae62fe709f78df16fedfc9da3391b51eb7b8d139f402648602c927beb1bc7fa78351836d593524217f7a4f2fc33a5caefc5156c01c3f210989434023e1815cb26d0d0b3b84"}], 0xa0}}], 0x1, 0x4) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) shmget(0xffffffffffffffff, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) [ 332.188824] binder: 12128:12129 transaction failed 29189/-22, size 24-0 line 2896 [ 332.219633] binder: undelivered TRANSACTION_ERROR: 29189 [ 332.234042] binder: 12132:12133 unknown command 536871040 [ 332.239735] binder: 12132:12133 ioctl c0306201 20000440 returned -22 07:10:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x28, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000"], 0x0, 0x6c00000000000000, 0x0}) [ 332.348404] binder: 12132:12133 unknown command 536871040 [ 332.354289] binder: 12132:12133 ioctl c0306201 20000440 returned -22 [ 332.364218] hrtimer: interrupt took 36625 ns [ 332.441524] binder: 12139:12140 transaction failed 29189/-22, size 24-0 line 2896 [ 332.472285] binder: undelivered TRANSACTION_ERROR: 29189 07:10:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x29, &(0x7f0000000000)={0x4}) tkill(0x0, 0x10000a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x80, &(0x7f00000000c0)}}], 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_pts(0xffffffffffffffff, 0x5) 07:10:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) 07:10:46 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) epoll_create1(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/4\x00') preadv(r0, &(0x7f0000000700)=[{&(0x7f0000000600)=""/246, 0x2b7}], 0x1, 0x0) [ 333.062095] binder: 12150:12151 unknown command 536871040 [ 333.067772] binder: 12150:12151 ioctl c0306201 20000440 returned -22 [ 333.174047] binder: 12150:12151 unknown command 536871040 [ 333.179669] binder: 12150:12151 ioctl c0306201 20000440 returned -22 07:10:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e13753584a74d36ef76", 0x13}]) 07:10:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_open_procfs(0x0, &(0x7f0000000100)='mounts\x00') mkdir(&(0x7f0000000240)='./file0\x00', 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000000)=""/177, 0x298}], 0x1) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000013c0)='ramfs\x00', 0x0, &(0x7f0000000000)) 07:10:46 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000040c0), 0x1000) write$FUSE_INTERRUPT(r0, &(0x7f0000000240)={0x10, 0x0, 0x2}, 0x10) 07:10:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096ecc0691dd954"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:46 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa#\x00', 0x3, 0x8002) pwrite64(r0, 0x0, 0x0, 0x8002) [ 333.688330] binder: 12177:12178 unknown command 536871040 [ 333.694309] binder: 12177:12178 ioctl c0306201 20000440 returned -22 [ 333.749376] binder: 12177:12178 unknown command 536871040 [ 333.755314] binder: 12177:12178 ioctl c0306201 20000440 returned -22 07:10:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:47 executing program 3: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000040)=0x1, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget(0xffffffffffffffff, 0x0, 0x100) r1 = socket$pppoe(0x18, 0x1, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x2000000000002, @local, 'bridge0\x00'}}, 0x1e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r2, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f0000000980)=[{0xa0, 0x0, 0x1ff, "f1da3134407c43ffb6bba21089da458c26e81ce9492b199f8f04561af3a7c7e902ca723e2a27fba05c7126b7a9160a73469f9925bd0c11875eac7c9a13bf3d3b2a973124a2116327ae62fe709f78df16fedfc9da3391b51eb7b8d139f402648602c927beb1bc7fa78351836d593524217f7a4f2fc33a5caefc5156c01c3f210989434023e1815cb26d0d0b3b84"}], 0xa0}}], 0x1, 0x4) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) shmget(0xffffffffffffffff, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) 07:10:47 executing program 4: eventfd2(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') readv(r0, &(0x7f0000001a80)=[{&(0x7f0000000600)=""/115, 0x50}], 0x1) 07:10:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00009604aaed000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:47 executing program 5: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000200)={0xfffffffffffffffe, 0x0, 0x100000000, 'queue1\x00'}) mount(0x0, &(0x7f0000026ff8)='./file0\x00', 0x0, 0x0, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)={0x2c, 0x6, 0x0, {0x0, 0x0, 0x3, 0x0, 'syz'}}, 0x2c) write$sndseq(r2, 0x0, 0x0) [ 334.251504] binder: 12190:12193 unknown command 536871040 [ 334.257352] binder: 12190:12193 ioctl c0306201 20000440 returned -22 07:10:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:47 executing program 4: pipe(&(0x7f0000000080)) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r0 = getpgrp(0x0) syz_open_procfs(r0, 0x0) 07:10:47 executing program 0: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1000, 0x200200) ioctl$VIDIOC_G_STD(0xffffffffffffff9c, 0x80085617, &(0x7f0000000040)=0x0) ioctl$VIDIOC_S_STD(r2, 0x40085618, &(0x7f00000000c0)=r3) [ 334.765260] binder: 12210:12212 unknown command 536871040 [ 334.770995] binder: 12210:12212 ioctl c0306201 20000440 returned -22 07:10:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:47 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000040c0), 0x1000) write$FUSE_INTERRUPT(r0, &(0x7f0000000240)={0x10, 0x0, 0x2}, 0x10) [ 334.934775] binder: 12210:12213 unknown command 536871040 [ 334.940749] binder: 12210:12213 ioctl c0306201 20000440 returned -22 07:10:48 executing program 4: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) 07:10:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0, @ANYRESHEX=r0], 0x96, 0x6c00000000000000, 0x0}) r1 = dup(r0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000280)={0x0, 0x80000000}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000300)={r6, 0x8, 0x40, 0x6, 0xc8, 0x7}, &(0x7f0000000340)=0x14) futimesat(r1, &(0x7f0000000180)='\x00', &(0x7f0000000240)={{r2, r3/1000+30000}, {r4, r5/1000+30000}}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x8) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000100)={0x7, &(0x7f00000000c0)=[{0x0}, {}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000000140)={r7, 0x2}) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000380), &(0x7f00000003c0)=0x4) 07:10:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7542e", 0xa}]) [ 335.351257] binder: 12229:12230 unknown command 3 [ 335.356539] binder: 12229:12230 ioctl c0306201 20000000 returned -22 [ 335.441005] binder: 12229:12231 ioctl 2400 8 returned -22 [ 335.468999] binder: 12229:12230 ioctl 40086425 20000140 returned -22 [ 335.486612] binder: 12229:12230 unknown command 5 [ 335.491740] binder: 12229:12230 ioctl c0306201 20000000 returned -22 [ 335.500585] binder: 12229:12236 ioctl 2400 8 returned -22 [ 335.509606] binder: 12229:12236 ioctl 40086425 20000140 returned -22 07:10:48 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000004d80)='./file0\x00', 0x800000040c4, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x9) r2 = socket(0x2, 0x3, 0xc) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'bridge0\x004\x01\x00'}) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, 0x0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f00000001c0)) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) 07:10:48 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 07:10:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x20002, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x30, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd8, 0x0, &(0x7f0000000180)=[@register_looper, @enter_looper, @request_death={0x400c630e, 0x0, 0x1}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, &(0x7f0000000000), &(0x7f0000000040)=[0x0, 0x48, 0x38]}, 0x8}}, @clear_death={0x400c630f, 0x2, 0x4}, @reply={0x40406301, {0x0, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x30, 0x38, &(0x7f0000000100)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @flat={0x77682a85, 0x3f02db6b3973d61, r2, 0x2}], &(0x7f0000000140)=[0x58, 0x0, 0x30, 0x28, 0x78, 0x18, 0x38]}}, @decrefs={0x40046307, 0x3}, @dead_binder_done={0x40086310, 0x1}, @increfs={0x40046304, 0x4}, @exit_looper], 0x87, 0x0, &(0x7f0000000340)="4457254de9cfeb110717929435c78f971cd5921535fc97586317d490029cde6531a600bafb9bd457dcef7826c7652e2ef74437a1774ce6186416ba2feb935b71956b002bc01e1517a9ffcf228a52d717eafa913ac1d60e598898c9442aec28d6f9deebee65f1e573ad215879b9cc3f8b76a5c8502805345b3b221bdf4b2383b4acda0539fb158b"}) 07:10:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:48 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup.cpu\x00\x86o\x9br\xcc&p:4\x96\x1dn\x17B\x00\xbccT\x8c\f2b\xd8\x80\xf8\x19\tq>\x8e\xb4\xc8\x7f\x00\x00\x00cU)\xae\x8f0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) 07:10:49 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f00000001c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00002b9fd4)={@multicast2, @loopback, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000231000)={@multicast2, @loopback, @loopback}, 0xc) [ 336.015800] binder: 12240:12241 unknown command 536871040 [ 336.021467] binder: 12240:12241 ioctl c0306201 20000440 returned -22 07:10:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000b1008080000000"]], 0x0, 0x6c00000000000000, 0x0}) chdir(&(0x7f00000000c0)='./file0\x00') 07:10:49 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa#\x00', 0x3, 0x8002) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="fb", 0x1}], 0x1) 07:10:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000a8eff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000200), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) close(r0) 07:10:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="92", 0x1}]) [ 336.480836] binder: 12269:12273 unknown command 536871040 [ 336.486651] binder: 12269:12273 ioctl c0306201 20000000 returned -22 07:10:49 executing program 5: ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) r0 = socket$kcm(0xa, 0x100000002, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)) 07:10:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 336.566023] binder: 12269:12273 unknown command 536871040 [ 336.571706] binder: 12269:12273 ioctl c0306201 20000000 returned -22 07:10:49 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 07:10:49 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x4, 0xffffffffffffffff}) dup2(r0, r1) dup2(r0, r2) 07:10:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000068f8090000000000000080000000016639a58b7b619c053e55c7bd2e0f17fce3485425db3fbc13da5243d6d28da6ca8dc0a87a7abecbce05cc38a0a673b17e025d8169d50f44ebe6db07b4a1d5d49ba29043ec7c366d4c7e1a2b13c39b00000000"]], 0x0, 0x6c00000000000000, 0x0}) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x102) write$cgroup_int(r1, &(0x7f0000000100)=0x8, 0x12) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f00000001c0)={0x4, @pix_mp={0x7f, 0x7, 0x0, 0x1, 0xc, [{0x2, 0x6}, {0xafab, 0x320}, {0x9, 0x6}, {0x4, 0x9}, {0x2, 0x7fff}, {0x5, 0x68}, {0x4, 0x7}, {0x97d, 0x2}], 0x1ab8, 0x0, 0x1, 0x0, 0x5}}) set_tid_address(&(0x7f0000000080)) [ 336.732917] net_ratelimit: 26 callbacks suppressed [ 336.732937] protocol 88fb is buggy, dev hsr_slave_0 [ 336.743844] protocol 88fb is buggy, dev hsr_slave_1 07:10:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db0097636", 0x6}]) [ 336.935902] binder: 12297:12301 unknown command 536871232 [ 336.941705] binder: 12297:12301 ioctl c0306201 20000440 returned -22 07:10:50 executing program 5: capset(&(0x7f0000000280)={0x19980330}, &(0x7f00000001c0)) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000010407031dfffd946ff20c010a200a0009000100031d85680c1baba20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x13000000}, 0x0) 07:10:50 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 337.018921] binder: 12297:12301 unknown command 536871232 [ 337.024744] binder: 12297:12301 ioctl c0306201 20000440 returned -22 [ 337.053088] protocol 88fb is buggy, dev hsr_slave_0 [ 337.058768] protocol 88fb is buggy, dev hsr_slave_1 07:10:50 executing program 3: r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) epoll_wait(r0, 0x0, 0xc1, 0x0) [ 337.212931] protocol 88fb is buggy, dev hsr_slave_0 [ 337.218731] protocol 88fb is buggy, dev hsr_slave_1 07:10:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0xf0) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) 07:10:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db0097636", 0x6}]) 07:10:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x100, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x180, r2, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x8c, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10001}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x16}}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffc00}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'team_slave_0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}]}, @TIPC_NLA_LINK={0x58, 0x4, [@TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}]}, @TIPC_NLA_MEDIA={0x30, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x15}]}, @TIPC_NLA_MON={0x44, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x80}, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0x10000, 0x0) 07:10:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0x3d2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x81) r2 = dup2(r0, r1) clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000440)=[0x0, 0x0], 0x0) ioctl$sock_SIOCGIFBR(r2, 0x8940, 0x0) 07:10:50 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00\x86o\x9br\xcc&p:4\x96\x1dn\x17B\x00\xbccT\x8c\f2b\xd8\x80\xf8\x19\tq>\x8e\xb4\xc8\x7f\x00\x00\x00cU)\xae\x8f0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db0097636", 0x6}]) [ 337.772672] protocol 88fb is buggy, dev hsr_slave_0 [ 337.778292] protocol 88fb is buggy, dev hsr_slave_1 07:10:50 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) fcntl$setstatus(r0, 0x4, 0x2000) 07:10:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:10:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3e, 0x0, &(0x7f0000000000)=ANY=[], 0x3da, 0x6c00000000000000, 0x0}) 07:10:51 executing program 5: r0 = syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561b, &(0x7f0000000080)) [ 338.154411] binder: 12367:12368 unknown command 0 [ 338.159547] binder: 12367:12368 ioctl c0306201 20000040 returned -22 [ 338.325446] Sensor A: ================= START STATUS ================= [ 338.333422] Sensor A: Test Pattern: 75% Colorbar [ 338.338245] Sensor A: Vertical Flip: false [ 338.342629] Sensor A: Horizontal Flip: false [ 338.347087] Sensor A: Brightness: 128 [ 338.350934] Sensor A: Contrast: 128 [ 338.354663] Sensor A: Hue: 0 [ 338.357731] Sensor A: Saturation: 128 [ 338.361578] Sensor A: ================== END STATUS ================== [ 338.398057] Sensor A: ================= START STATUS ================= [ 338.405118] Sensor A: Test Pattern: 75% Colorbar [ 338.409967] Sensor A: Vertical Flip: false [ 338.414462] Sensor A: Horizontal Flip: false [ 338.418937] Sensor A: Brightness: 128 [ 338.422847] Sensor A: Contrast: 128 [ 338.426509] Sensor A: Hue: 0 [ 338.429563] Sensor A: Saturation: 128 [ 338.433472] Sensor A: ================== END STATUS ================== 07:10:51 executing program 1: perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x910, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCEXCL(r1, 0x540c) 07:10:51 executing program 3: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020f0000100000000000000000000000080012000000010000000000000a0c00060000f2ffffffffffffff0000000200e00040010000000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd701000000000000c7"], 0x80}}, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmmsg(r3, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) 07:10:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:10:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000340)='/proc\xab\x8ao[\x9c]9\xe2\x80\xfa\x84\xec@\x02\xb3\x85\x97a\xa7\xbb\xd5\x0f\xd8\x9e\xa8\x8f\xfe\xd5\xbdsys/net/i\x03\vpv4/vs.secure_tcp\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000100)={0x3, 0x4}) r2 = socket$alg(0x26, 0x5, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0df36e36ab34b70f6a00dda5340e108b37f4678a22e4f32b26f932ba8a7943fb4f6e1b625ee1c56c6349801fc721f3f82c3f66a82c7d1c16664a3cdd0275fe592a3ad7ee357895b013b085648eeb6595b09e52c5632cf9d9f0c3a73d9d63d866d6e2b65ced7b6ec5e2118c02eb5cb0ec1d28497a2121e66ba2d868826f88bda892138779abe5a7e434ef8cb3479bce546e934b6d308507f164e4afaef40347d42c7fa131229eac7975c3e031b427950493f136c6a331ab531867bae66336f0903c73b7b42a198c5f9c6cac3b984eaf372914e6a6948a9f937fbf4d106166e98a60b135a968160600000000000000ce0be60b06458a9a81ecf9cf92b50000000000000000000000"]], 0x0, 0x6c00000000000000, 0x0}) 07:10:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) 07:10:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="852a62730caa1c"], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, 0x0}) [ 338.989261] binder: 12466:12469 unknown command 536871360 [ 338.995014] binder: 12466:12469 ioctl c0306201 20000440 returned -22 [ 339.080841] binder: 12474:12476 unknown command 536871040 [ 339.086749] binder: 12474:12476 ioctl c0306201 20000040 returned -22 07:10:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) [ 339.138095] binder: 12474:12479 unknown command 536871040 [ 339.143889] binder: 12474:12479 ioctl c0306201 20000040 returned -22 07:10:52 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:10:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/udp\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf32(r2, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x199, 0xf0ff7f) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") 07:10:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x48) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000960480801f00006ab0d9df3759a4893e11913a3b835fb334067e7927cf97d7d11d4d852eeaf044800b04f343cc0c6f084dea60d23cf0aefe904ffe931621be0c352e3a2430fb4c9dba58be03d00c56cd6d3863b03c740a303f3299cca57ee4a52d3077fbec19b2a5d49da2c735c68368f1efed957878f61b0fb9469be7fcf9385ca42fef85becab8c097c34566c47fde147562ce8152a772b1d828039b08be7a37d4b3047b0bf30c36a6facded04ea293820a44c5553d1092e1ba55986d6c184494a56d51d6375ebd0a63be1dc945bc9c9d2c9b95766c9260244a52600371d19da1be90af0f7e3aca65bc1917d8540ae2984913c64a95b1be019145e902ed5b09f4c1e943fdc5980697c4235b886"]], 0x0, 0x6c00000000000000, 0x0}) ioctl$int_in(r0, 0x5424, &(0x7f0000000000)=0x9) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x2002, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000480)={0x2, 0x0, 0x2080, {0x13000, 0x7000, 0x2}, [], "fc567c0d9b2bb971166a1ac849fcd5e36ca5aa6496f661ecf7b1c19ddaf4dc25aede7409d79049f26ff9d52e951193808161210802e4f357cac01e929b3733d14fc3f157f1ee141c090353379aa2fa31810dd5f6ec57df2c9d3b1608b97a351b37b0fb2fde246759b69555bdc206364de120cc2283d69b69baeb069dc0dd7b8d85680fbfc4b2a9e57a46cd56507750a508bd0de44f08d9696ad6d77b5a8d78db3af4d4c531bac0afce50a09d173b89090aa45bef21636f74d2e9c8469a3e92ef57e03dcac3253f542dde98b1cb2159d2661144346f1b1113953fc6fa5c6d3a82a39d03ab2774501241db94f580f54d3b8775a2cfe9292192342e085ec8d68d5ca163968b043575f096debd3979c637de0a6a67b7d66b9ea2006d09e4b84aec2dfeb9105a3e762dbb9181efd22e142f5f8562267a8751b7198a47cbf37c1a407d71c6e22d0df628bf6339c86c7cfc0970c1fec2b064271d4e403afea0d554fab93452192cc4598f43dcd9af205a7e77dfe7d871ba560aa85685ce4abf4d1204ca640317aad05107da9c54b8ab1ba582a8bdfd63fcd976577d821c0d021cd4df4294f652855d4523e922b171be7754c5d57f6ae35a84fc7281479296076296199e7e6c72dd41c9d6204dfaed634f59b9c9c40be4b9d6b63176fa28ab85b6b54b92f30b5e998841243f2f3a994dd11ef183cdfa73210f9d6020b87cbd708adcbf160e502efa36b35023d6d9540996e5ef67778b6d8683e7e11b4b57703abfba7460629ba6cc6032877ebc15cb99128efb8c791d4d4f3797f69738d4b6a758832f9c970cab7214f701a58d53caef292c5a55cc97fbf3764db01ce44d626d2d1e1006c73e0b5ddb1d9834b95a02489cab38665edfb6b022254686f49e778a1436a425bd5be2494aa0fc174f5bfce0d0e093862c860c198ec4a8d19abae653e34f76d26baf5454ebed936181d654a8a51706614f6aec3fdc3d72c02439ba2b38ad6ffc857a99c27eeb5528169c4f590e98e4fbbe4b8ff6b3dd32910c5497ad41cae63e31d4cba96b7f9bacbcc87efcfc065a544f00f0ada162ab8f1506b6f3da49f92c78a2c0a4dbd04d2e71581ad4ab14e6c9ba693f505ea528220d9f20ef4728d44748b55530acc33b0ff9e3093b5c188cdb71a6d016e771451cbe821028064c109e297dc975c488a93773ccca379ca6bfb61239dc949c358935d496b193c6b688fbb96323ff29eb3d47fba186db3464fd1b712ef6e2c979c099a2c23ebb9289d836206f3af52650e0d807e370a69f44962987e4d66a9b02ba875f1a4f78fb105e044c0eb31910b6840c0b6327634fedbf38d02e5fb97b083cd49b807629fda0d13bb36896b0986c804f9ad45915aaaf8c57d5f734f0cc2742dbf6615b9c6b126348ffd5f55f47bab7cee5c400b353c372a33b94d0a420c3fc1ec8caca9bd1dc49ef4aa2864df3c54bce4087c42d47a01e79965cfc44a04d5194c007607c6bc5b264362d47811934c6751dfa036f4900f198532c6e2be7de393637a569c0f1a8aa80e7d03f59580bb1755757d0e147f8d0dd989c9ed81324a861b4303d54135cbccd0740341247ed59600f299f4778b51e008626eaa6e70a07889f6bdc4596a9c55fb617fb561451f77cae6e5b51498d1552536dbe728c1de719adbe8ac929cee12d353256ea619ca848da290a78a555662b9c48022a66c1d368596dd1548260f38777dc8c3ad7143df52f9ec813d43507301a6a19b9d6dff274ed115f6e4c4ed54ab2b8417f91c93e9137f3412c7dff998fce0bef8324ef8c5289cc18e302c995de5390e9bb92b3247ef41c7270b3d73d985936e1628a65857007fab2fddbb79da4f3301e7b30f67667300f606e154fc171afc523fb5e4cc6d2c9b4a8443a2f3f236c1ed5daab828af6feb5a266c74bfcfa81d77de1bb039bc67c0d4bab2b4024487f58417aa8605319bace05e968f9267737469192b8701066ff2f18e7704dfd66b6dc5796692319016ca9a7395e22843706872de2c85a6db6ffbf96629e5a2c3fcf1ce383fa35555ae577f6276fe885f36711c7f31febd27cde8bbcd02f2d511f8ebf472b16a408ce0adf4905b97f7b64b56dbe56b397addfb86e595b9cad6c279f545f4009b7b8fa585eb7feb3e2775c2e8922dc814b509dac866b3c3ddb03e69e8225ff3aa8fb98b5b13067d0c202660db24965c3cf87c0fe6b466f108412f001f0e77ace0bb42045610f5cac680e729c2821eba272d16dc98caccc817897c047a5256bb6161bac97c967fb07acd37ab73cc3f59da8a052c1c9517342103a469c072470a607d1db4d413b924b4ab9bba57c9de2c8faf413211b4b70ae1b5e5da47ec8aac77ee52d61029f61e861e5509325083e74a35950a7d66999e108a36b0746e185ee79cfc50dcfa1dd5a6e38c5dc6ef5f6a8a397098b22cc09842cb58d349c240fe1794be1a57ed335864e2ed84678662f351d2ca83ae725dfae7edf327cb0c3d2a7ab135c4d13bfa3e9b2ffbf955ec6eb5df1d065b9e327e0cd9410ad8f857483792a932ac7b6ff1092a307a02ea0ac8cc10d1054058606b2c8c449794399ec207901c5b65fc77e1ba417b52c5a1aa9be5ac17fa231a4cf5baa82b2c12bdea7b2b5e10408600ab829cc1a0766cc3629495b4268a578afad6ac59d8b260ba1f855a9c226956f333a044a80a8947d7e6aaed62c77d8d6003e164ae8efadebc3f7ced93e612522828960c0708c0e23c77926f78e51afe20946d9912784526f69ffb3c1fe9a5806493c31e5dd02244284279d8889404cd3597acd1e7fb7b81e1ee89e56fbbd51d8900c3403aaa3ecd4c52edc7ff1df4a10be65438284b5e4b59e0fd0524f1f9951e220840233b5e5baa9938c2c1562131ce4765dfd15f1cfdc78e1c121b24bb6dcaf0b97c9538877bf5679936e4ba672b684872e3ee4c3956075ccc230c9dc1b344f8cbf324329ffe601efa0b827e07d24b8221bc8103f5481ba5ab37512bcd800e9a2833e22dee14a4dbb29fe067fb08fcb47f505d000a6e8f23663f157da1e56a8167d2cc80498d85406bb2430822500b5a24a895d70aa8465f939b98b4cbd39e65deb7e585b8cd60daf9a40abab2bb1cf4f0ad85830d4b348332f3d123ae87849054e8565a13c8f325f9c5b61515b2258bc7f4120249f2c67f5cea45a658e8d0eebc517d83a5c34bb00b1984b0ede6c2301bb506208476b9c70f65b641f414daf204da568d54809bddd8373aca0c66fbb7b028ca69fbc2c9b2f8206fcda70e2bdc1d1cb35dbcd3ed26f8964b8bcd6d8a8b98fc37fe0bc13e3665a0dba2d4bf089ba0d7c6cbc0a0ec6a502e05d7116025a2f3a3e1276a5b0aad4974ccc832e91e35c0ccdc8d0d4b248a5b8a4467776bc28ca70184ed06e66bed13453913147678edcda990c702f47947ef77102abe0a55d5bdf4176414731c57580bde9e7e1ec7fd147623e8acbc42e2353fa392d7e610942076d311a866a7ebf647b45b40c3569f81b25e0befd0bdc918e72a5b8b29726b3caeb108badde8788085e82f7c08e5c5c07ffeab4a11e9616cbfb1c323b8fcb2536ae078626202c89d9f0fa703161f683c12bdd712b0fe4c36784ac14014a9388b17429ba44b209719e820d04a70facec61df8fcae1415439b80c4648adc95d8ae05083edf9eb2770c68521099567e4ddbd3a676bb48242c0e54cec043e0956cd3c92325171a91d96f751fff7c3f922de316df3f7304f433701acaedf9f1207415922be97ad4c9409c66af0fc5426c7c093c3a0c68fc4df524080fa04e7cceebc1bbe5da1d0a41357afc14d1de030311d8d236b75284821662ea79d660b9a0f9a9958a1920b851fe19865b7122e68048c802a4c1265d325a8be6bfbf543d87d5efeeb2686a6ef424083e54cc40e5baea3e092efa86402e443ac39e1a7f77631a7e6646f94390617cfd05748d96b21ecb6a48f09935c33cfc7ca859c252200b0015c195cb124734314007abe948d4b50e10e1616664a7611a5cd00d36926ffcc2b2d81032ff7493622dd1271d5d5bbb523a2b88ae022b5ecd80811930076b8689f2e2043afd650f3391b4a6b2d51ed2aa372a4677a5b2f86a00aa3f2c5667e75246bd70cb024cc7ec63dfd861ec25dd4d90d8ffd8cd57fbc1d6d7e26c6d4fde0578313a45dda732a3a5ffaae46f57186fc39877b67b0974915370d33641f3b5f6c5b9f991025d31db8b2fa2bccf8eff61b6762297645532bd886dfdd2dce573274a5cffbba7924a55afc4f9c425dd1b458f80a5b55cd3a6e39b186912d696cb68de556d436da2a7865009620c3937747790a24ee3b5967296bca0a84c63b7563f324d5a98ffedaf334420f39a85b8bf9cb263cd759bc0105d186a532712cb3ff1bcd1fa2c444d1ff190450f794f8835bd32a1735a54d8d5f021dfa44ad64a1e1ebd2a93fb0004f3fc6c80282c5616c3c2acb0b916ebebb145abdc75e6d78e576db189c5fab2c64a1252318a799d5136ad604fba2eef1780536d2844533e720e8b429907df677fcef82a38f88bb2eb9da9d92eb7e58df1d3410864cfeec504b3fc28e6bd9ed10cd2d41673704f65e421a91d94f97ca5f690a1e6561dacadeff30503d25fad6c3d95df14276db31539517c63845968a7f5976e5dbf654840e4b8ecf1655ac2cfae1921dfbffa3725d9b8943b050cbfd7ffc90a60c9efd2b5da211e1d2acb7fac17949c2d0811cb32f3f01e41e70e80e632383b19f3e057c80d9eaf7b74dc37e48fe4289b7d36a41ccda57dfaebdc807c62914ab53e5f7ef0a2a2a42389aac6fab655d2f5965d4b0cf5058857adb3d9be4d016094b6427a4c6126d994427bcb6e201cf14d57c5cebb9c9c685f22f02a9223e0a6f26f781ce98a23e9857082a9937289ae34944591bef9d448a6db4709fac64d5f7933690ff74975908bdd59a55a9d2564f5af27a50d97aefb167f5e6341c976e38e459fd6a75d3678569e6ffbb96dd30471beb809c28b2d83ddf3ab1d0567ff7cb70693db02e33ed9bd9dca270fea994d6df893c49f59448c85792bc5cc344f6c92a2e64c3adbd07e4e34a61f1d09cb543a0376af51b54be7843fb22fd4eec51cfa1aeaeeb0a62b3a6b4192b6232087e7f013b80624e3431e20212a291b9b738f40f4800d3ad82683d3682f4a3313e8e154273a88b6652a3346627d605d6d5d0273ade2c102533447c5a236b3b76d7045919840c822fbfde94d51c8079b7e7d355ba07ee889eb8e494a495f3477b21580ebf1e8b7952f47568b08dad7727972bb8de8ef1bdbcd0881634ac6570eeeb2a9dfa16fcf26bb1c124144e435911bd2d1417b960f3355056084dc7a11399bebd91508cf2d27ee0aa6c800cd5f1349c1402cb611f68bc106602ce5c3129cd45019a5af9256b6909d17f865834828e32ba1a23de758d943457d734317fcd2af1855e002e25c206c84ee1337b14c05bdabb1aa47a0248f54ba4fb9e3ed1e6d6abde93457cdf02812228ebec4aa4aabca9ed597555bf8eaedd044837af3f9d724bd434f3b3bb5e6e37c6188e017f739fc1e49ab4409f062e773375e11e21977e1f97a0a956925b4f271763ed4331ce5ff989a3971e018c5b1ab795e1999ac978fa718a282449bb63f69892516d9cb9708fcdabf4b60d96a37c36ae035cfc59dd85c7851eb23ec00e155602f17148494004f5750222bac204d94a064cd105255be0d2039174a519bcfcd649375070c351a32de389d15b8b74bc780174aba60d1ace7f5e47257d0f05009ad4b73efcdd8ea23d95d1ebf89a02c3128e5421aede55", "0d9d2e4f0784e6becd1b669c6598296ab7fe999b956d4db8c73336ab9e8b21d60624172afbce898435500e2765ce764efd832c0e356ebd02c88fbba3545080cce3b29eb523f6a65cdaf40b02e16915ff635776681b761caa62eff35010550485d21e35ba5aecf07770031b6f83cfef394f58429dbd03cecc7c18a564d7dd798adf178150c18dfdb9a7842a5380b1ee80d329f8f73dcb33ce154510cdf8fea50f1e9d4273e947b19dd5d962d32eadad01644ac264f45291b0265cacbf21455e0efa0fa4ea81e26e2022cc4abc0d2e368d0b7ffd44d2a0907bde2b97ebe5a9b1ec02144bad7fea25288f2223cda446875dec38e33ae08d16cf801cafebc9b84037accddd634bc4e826dd977ac09c82f999ce6d9064a05d8c33856e2eff5a222a79f7aad0177b3fd9cec49d246a47b38eed38268cd43b61d057e1677adb6d6768d14722ee961806ed435bfc1149d50e6ba3ab583f33ea7aceda8d59c135f367c7162e891a7c306a574f2577b04e2acb70a800d4672b06ffe78fb542e9f21b616335b52e5ac3bfe6efba1621c2610dc537efdf9fa62f2dc6d53469e7219c9f55e5e2348e87672e04e4c1d095b9af8edc995950bda370eb1cbc92bbf670e0f3c54e5658f6a6128b0bb57ff3582b0bb8aae9f52dfb9c000439784fb9bd96c3b77fb95fb1543a603a6a33e2e87ae5087bb255a6a30fabee2ab69828858c7b00536ccba5102af9f14f368f0840c866f0f0be2e4259668fe23d96ca34f7e3bdd5a16e858a0d74874d6176a6c484f63280a28706b34b523645d4f3414d796aaa3f39c611d512b53592d4d6358895dd44087daafd3abd40bcf05a2a9542640adb672e58247841d9a847b7d0399bf6f3f627ce1dd17f14c724afea7e221f835c224eda4ca276cd17ff62f98f831de0c36a4fc092b060b8e23d8f317ce9b74ad2c416b28d921aa27e54c926d322af2974e90305b4554939aaf7a2dd4aaf47b0c3e5ca0593626c788678fe5cdc942d96d766f4b0e2ff9dae9a9463155ad8329799bc03e93235c80cae4c5d8d01f320d4e4111775a5008c88aa4b782c6d384827f848dd0721c27343e5839436db536d02e75fa9ad006d30efd38fed44e0e7b665ed8788354ecd2851fe5111c5abb6ed01429fcb04d7fb900a0ab859edf2f185f01be2172a547408c896ffb630f91cd1709c384e85c024fd0df5ef161feba5b6a445c80ec0bee2a9079aa308b5425173dadfca77ea27f2f2e6d13e48a44304bf0a25f3504af897c92ae4df9fefc34ce7bca8c769026839da9c5aec3bc4cae665845a9fd7b62964f883a67955961fc044b45c1c9a251d313d73e1b13f44f4aeb009eaaadd6bcdca83d25327280d359ad4be60120f96753b6241e0b17efe436b4a7080c982561317b4cc095d534a0414ef535afbcac820211467b3de792463365c07f680b06d5a87341b10117a7d112e08dde0a7d6baa07a1231e7556fb1f36e0f6472c8526ffb56c62795e51bf9fa60da0e90f940321e43fa24edff554a3dfb70aa9706574abd37ade5446bf2c420d4d9ffd5245ec97ffb171873852a6cc822a25deb9c8bbb5166352807e73e4caff4e67f0b35b9ccef003c0f967de19f7f76495697b46be670b2ff666e1f9fbe4b0888b63ca595d850abe21b602ab3933111c65266e70130143e4c90d2ecc111f9527c42c9621d82b46321384097d3802c61254f8fc34bf2499672171b29690f7e90a4a3ff1279fb3d4cde4bf60311a630541e31e1afed5b38ec097a4042ab0e82614b0ddad089140774d09709998fcf33bb5fc11871ad585a3bc393bc7d044d46135fd1f0fa8665c2a4c1de12b3eec52c58dfccc2abad6a1c0cf398aae5b14b462005e6cb6778346e980560bbf9fb75d12df774ca94e37267e750a9704b8d573d5dd054bcaf7bfc4a4ac05731bd985ffc68fbd148b32b7f8bf33efc9b08bb06c036248abc944a8c29815508b8f42b1f336559d407936b079918523b60a8428c556c778bf662b943e201bc0a1ec80c91b0d0f8a49853d0ea4c5973791b165aadaf0281628bb56dc154124c4280e80cacb7b0f7c10bd723db655d6abcdc484c15d29f3b041906ad73e43c7c445564cdad143d9aca96505c71920676c32a96f3d5f31711c6f84ab15595138863667c0775f4e7e6a6adb287b279fff776105f2fae907870bbdeb297ca8997afa544fbc1f9fbf71c4a7cce65532f457615063ac0235f01173fdfd24122a57e4dd34928e4f5b7909186af4dbd8c4c23640fbe0e440089c080526f945c03947c4e0387ea6ff08e9964c6d56c1cd5847e65d069ab3aa98d0546dc791f6dcbfa9e2525520bbaae74cf9a97520e0445e2efa8ebeed3ee267f0e73eace47c68a4a943c403bb6f28088c6170f914dad767b90e60176118c2d6689d0cdc8f61d4fe56471e7ff458223cf525f6cff1770be28893b5329bf35bba09d2f02f7c4a413dca26c013abee7cc8c1bf6d3b985ed1d25e4a3eb63f52319b59df4d6702c28ac1c7521d7eede2924e6b96977aef97bc593e2a45b50278d01c87129b009ca343b159a38380ee3e05c10b5c8ff7e29a5e060fbaecaceae0b4089a09a1c5cf5c9a2a00e906d1917e1f0787d32f9eecc2e7a0eaff98e16f4366657039d6b563961c4011cba6ea84dde78bce98299c31cedb73f570f0a818b37b604ee6a55c15cd1de7a455d7883577167026cd20888268989d8ed36cf0b045700cf7ab666fecb4372dee85064e5e948c05377823e7eb1ba2e719b3dad8cc80e30dd581bd3be0c4af7c13be817be0f708996625b1880f475a84324610defbb4b4359f3dc1c0149a399407d92f34855de6821f972369562cb3e2b2eddcda97c4a3d3904a7ec3672c9cf1ee1efc2b36f87d3eaad428c2a4017750690ee3ded488cd927681cf52d1bbbd0d8df2424445cd445b1bf3335872da59a98805715815af9b2fb4bb9e2062c9c891ddd3f042e9c5b1f7e246a316cb8665ca817d2bb030cedd40889442a44a022c38e9713600b1d6a2b4d3daa4b1dddebdac4f993cbced8fc6ef12ca4614b5ae7764eeefc5406428533ad2038e62426af0123f15b63b2447bd0691aacb1dbc9492e0826c180f8eff90e90600166b3bc58909643f70e722aead281d4c9f2d3dab54eaabf9fc498fbb99dca421ff040dae2ce76270b51c3f9b8fe8fdc3ed537eebf70466849b318a96ac013f48b2e2b068f8689e96980c6367b5e7794e4407e5ced16d2686f18849cfdd3045013383ae3e9445f05e265d33f9ded5dbb7b0b834790fdda7877ee83706b5b2b86d51c0c9edae35a13334de3791875e3e0c12bf92c40813c058191d3682686cdf21f7367f349c26ec0c8a2f952b511bd72fbda5e956583d1caeec1992d31d48e7201f224bf66b5a532f26387981e329d77edb31552190175fc31a1afae340c23b92b238af03b4771fdb9ca0211830ed3483d95dcedc95010b45e747b9434f44e9b139b7d094357de01b5d7742f5650122ecc589f148159ad51b1a05c50a2a6bb036d8d0ec091f4a6baca2050cfb2bd8b3498e04c12b95d14d39f8fa83461bb6b61e5c6fbc077985d7d3755b76fa9393bc95a89fa6f796d6ed94d4f6a0ef7ced6fad362f2388a5eb11015fbe192ccda2b1f24d14584dbaa7f471da17544c8334fb8d3fcfff9f0d3213c8667a9ceb3c54f07a3d766af381a61ec067ba2c2e2396f5517578ec56a6bb01ad32b0e1ea6608a74df55e531c268a35d837b128125a0beffff251a750b6c14bf08db092506583cab672f0edf8f3e95c95736c05cddcff2d0ac75e1baecb181cd11b2fca8613058dd9c314f277a5825b002e8665e3101333e7aaa4e42497268e36f628168683d7e93c6573c9fccd1eff161c0f5df5aa38ebd79ea368aef4552401c807859bf94d25f65b9e7f536e0e3a20fd063d50260dec31bbc07fc13dc4e703652d32405cad61812c09045ef7fbf1ffd2f44b17e3a9a3c2f0d4652ff0fb066e8c07954e078a29feca63da787351d50d4aef79a2f961d4a1065ac285351d28b98e09a2d4258108e8d0beabf69373b6bef9e11138fc6b9da36ceddf535c104cb6dccb21e2059ce539695b37bdc3cd4203357c70bf1abb19dad1939ce75226d86c356bbaf6e825b3a0a826cab73e5e48cae8b4c758131df12c873cde8c3e951c9173aafd8d1c1b0b4fba6a1213c29b6025ee51b232e2f227750042599e9e819ed53fb3a1c6fee732e18d840b3c61b3c56a4098fb33cf7af7f85ea16a2557204e155e9591311f81a7b708e3c4f8c654284e2cc2fad65e24efe83efaa233da8de9c6d12e2e6e4d6a91b59f7aad04d2490ace4b2e608185465e9b390cad49cce8174f6725e9a0291686694ce22c7acad60620745111cfb9c7c0f2dfb67cf9c2ef0e871257daa57bbcbb52b5d7765856724711a4115fce9aeb9f65589cc6257c7b472c0a70ebb4dca901464303d5662a49b511ad8dba9ecf653a1b588ce3ed98d4cea1b14ea94e61ccbd56ff39e1579f56a8a27389a84e3be3b2f370a7b5c7e95216af3575aff3ad13982e92e22050325d55745bafd91114016c70b896b0c8ded43892e6d03c283b9a301cd3535e7018d459c69657d5fbc2eee7253334e4b1fdbdb4532ae2f960c79a317af94caa6e1eb3c5b18164537e304c8c7f1514929000d325436de7590ddbebfea30d217247b6358e084d47013e7181423c6a73af442b507000f661b4e4596e72c41ef2f96a58bc0e334eb51b93e904ee151cb59120cfeee7de2809ed0b0cefce1c815f19db07fd0ffb8d4fb800a357ee772325a8b42d4d75bc3ee661bc6bfc6ccb7e5cebce116e6b1a205598df5e707bf22aa833d66130a8412942dbc228e964048f32f5673f7de219812ae1a2b0367db3b1b1cf1664b81036bc266dddcf44cc93b21c9e593b9001109056be9c6f4ab7051c72357c707f04324f8d81eebdf93ac5cbf044849610d76e1f678f46d3456511b0704ab0a6f1309f32415ebe21769f8f5c0dec231046789d07e23b0c8eb8b6b8a7c7d8e8f32b45396c8ef17f893b8c46d93738552b71091395102a3bf003610ee556b000d9551acdcbef0df015a462dfc065b010f7f0bab099f195746f5166d1658928409aa6d16cd8eff63b1590cbf708d1ae5774f82d049122d04b2fecc7fd172382f458e1b3e119abae056b451d8df1c02a7b0d381bc0ea9f67f6f2ca9795c81b96b8b638bdd2300a05b1f5e4e9c8e44722feac77512c923b028589e9ec33cafc2cb8463df4f4715bd06d5f7b99239b381a2598bbd9b4581be4f8b95eaa152078420ac482cc1b918c0b8b4560910a08e1d86fc62590a1bffa1c4153f8149342bfdded5954b298acb8b5f11380ac645b91c7ea074fa3b418da9f9a91d46a002701c5d57536f5be02a7e5e81016e7599ad8280b3658af90d935a00570e5bc34ed99f007396413efe3c14855d63010445233c6d8d5331ba11591ead0eefcd99604a527bdceac43e59383526d1e90cc501e1fe73704506862c13c5e2677a20fd11b9b71af3a9a3b9afbea20bc272e9fc51e897b4929e6ea01282aea1f86ad7187f1a11455db7d3902329f83b165758ea698b185ff74b46c0c975badeec6e409f67e8567e2dd845589268f361f6547f67d82d4d724a546398234395c73b54de2cc5933ec37630e68089ab9c850f5261a28721c4653792facec612a6b6a0bc162bbb24cc849a06e76b9f48bbc353ab80c93c648171d5b4b7e33c39e5b663781445e261aa82c9217866fea86b85edf6e682c2cc55b016576578604b1444532d72c03cbd054a88a3a8aef1"}) ioctl$VIDIOC_SUBDEV_G_SELECTION(r2, 0xc040563d, &(0x7f00000000c0)={0x1, 0x0, 0x2, 0x3, {0x800, 0x40, 0x0, 0x7f}}) 07:10:52 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x10000000000025, &(0x7f0000000040)={0x1}) fcntl$lock(r0, 0x5, &(0x7f0000000180)) 07:10:52 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) ftruncate(0xffffffffffffffff, 0x3fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) [ 339.576148] tls_set_device_offload_rx: netdev lo with no TLS offload [ 339.610696] binder: 12495:12501 unknown command 536871360 [ 339.620046] binder: 12495:12501 ioctl c0306201 20000440 returned -22 [ 339.679457] binder: 12495:12504 ioctl 5424 20000000 returned -22 [ 339.718043] binder: 12495:12501 unknown command 536871360 [ 339.724073] binder: 12495:12501 ioctl c0306201 20000440 returned -22 [ 339.750737] binder: 12495:12504 ioctl 5424 20000000 returned -22 07:10:52 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) ftruncate(0xffffffffffffffff, 0x3fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) 07:10:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) flock(r0, 0x1) [ 340.141016] binder: 12510:12511 unknown command 536871040 [ 340.146982] binder: 12510:12511 ioctl c0306201 20000040 returned -22 [ 340.331687] binder: 12510:12513 unknown command 536871040 [ 340.337672] binder: 12510:12513 ioctl c0306201 20000040 returned -22 [ 340.400705] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x6c00000000000000, 0x0}) 07:10:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:10:53 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) ftruncate(0xffffffffffffffff, 0x3fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) 07:10:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00080100008000000081cececd"]], 0x0, 0x6c00000000000000, 0x0}) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f00000000c0)=""/189) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x40000) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000180)=""/97) [ 341.123388] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) 07:10:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 341.177366] binder: 12527:12528 unknown command 536870976 [ 341.183417] binder: 12527:12528 ioctl c0306201 20000440 returned -22 [ 341.204590] binder: 12527:12528 ioctl 8040451a 200000c0 returned -22 [ 341.255328] binder: 12527:12528 unknown command 536870976 [ 341.255507] binder: 12527:12529 ioctl 8040451a 200000c0 returned -22 [ 341.260985] binder: 12527:12528 ioctl c0306201 20000440 returned -22 07:10:54 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) ftruncate(0xffffffffffffffff, 0x3fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) 07:10:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/udp\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf32(r2, 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x199, 0xf0ff7f) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") 07:10:54 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) readahead(r0, 0x0, 0x0) 07:10:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x29e994bc5cb4b3f7, 0x0, &(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES32=r0, @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRESOCT=r0, @ANYRES32=r0, @ANYRESHEX=0x0], @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="fe3005d5b404fff9f93fbaae1c0b4df86303040e86bdbde7bdf7f71ad897398946ed01f943191f902104c99a5c3e124e5a4401ace2aec4ae93aac7856234f0e28130f77eada997edbfd642bac379fad628c86fbcd7dc9eb28820ee1e0c17eb32779c64d8ee9f54c03adc6bff81d1ee44c5ff22f4301ea730a9", @ANYPTR, @ANYRESOCT=r0], @ANYRES32=r0, @ANYRESDEC=r0, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYPTR64, @ANYRES64=0x0], @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRES64, @ANYBLOB="bd15656351283df2c650426e806710ea8e2714ab3fe658f6406ae59cc1777169594d0dcb2f1849bf253871c5ef326f06a5f7e17f1c5653a5abd95a0c98a66a87101e22bb41630aa435493ca0849b108338938a455a34548fc08dc6ac818f9168ab1982b16768e25848eac6717a59384d28428ec17b0e8d48d0e137277934f4074769834207497c7a1e5a4eac2494f311df3137d8a485b187f9371adede08944e4d0c6a57fe7305", @ANYRES32=r0, @ANYBLOB="3691e5d1d37639bbcf095b5b81ab9291343ddb461e0d0de4048edab88827b3bc3d67ff9fd47e2f9971410dab490f88c69ddf108de2effd6d888966df8a18e833ad3576b04aa1f0737a2a0813c9d50817549f7e84e87e76e7888b32372bf6d43d7e1e633aff6375ae7dd43544c0d015a501ad39a951d1215f25e787c5a9ef6ec4b24d750bb070d7289b2010e221150ed37dba66a859917b5bee27c486f57ad1020947b74d9e62ec6d2779e731", @ANYRESOCT=r0, @ANYRES32=r0, @ANYBLOB="526205bc425c947a313920d36c852811293c333259475a72e1ecad8006657a3c093b4b91981d26be7022e931c7948ff4c0153a9f5fe79e75e80411e1469ffcec93df56f7278ad12aee2144dd9d7d7ebaf0e2c1a56f8569c8bab0358adf118d2456c71d02bf5e85b9184ef125983e1528e67c3d1820a58a21f6d55cf8", @ANYPTR64]]], 0xe4, 0x6c00000000000000, 0x0}) 07:10:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 341.573382] tls_set_device_offload_rx: netdev lo with no TLS offload [ 341.606994] binder: 12547:12548 unknown command 536871360 [ 341.612804] binder: 12547:12548 ioctl c0306201 20000280 returned -22 07:10:54 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000300)=""/182) r3 = open(&(0x7f0000000000)='./bus\x00', 0x400, 0x2) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f0000000640)=""/4096) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000080)={'g}e\x00\x00\x00\xe6+\x00\x00\x00\x00\x00?\x00', {0x2, 0x4e21, @local}}) r4 = dup(r0) bind$inet6(r0, &(0x7f0000000600)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f00000003c0)=@dstopts={0xff, 0x17, [], [@generic={0x400, 0xbc, "e0b0a2faec2d0f4e2553ed4075b29e8035be5c9dbbe9a4059cb9c218d78ebf69a85c820e7fd909841acf16a17fa94aafe8859cb4966d3a998af4742f0078bbbf9350d5c3fd57f0c8a0120df2c096d668b77706dc9bfe70623d050d914f63cb163fdcc02ff4c81bbd46d505e19334e2fa305d781db499d60d31814affd3db8ca729bd9ffa55e1f56ca65516a5fcea7db0165237b4544c2d9b8063fe67538a9158317f50fbccf9a846d86d8cfef51f77e131c3e351e55289e868e02b3f"}]}, 0xc8) connect$unix(r4, &(0x7f00000000c0)=@file={0x0, './bus\x00'}, 0x6e) [ 341.667778] binder: 12547:12548 unknown command 536871360 [ 341.673526] binder: 12547:12548 ioctl c0306201 20000280 returned -22 07:10:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e754", 0x9}]) 07:10:54 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) ftruncate(0xffffffffffffffff, 0x3fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 07:10:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7ff, 0x200) sendmsg$nl_generic(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000480)={0x454, 0x2d, 0x301, 0x70bd2b, 0x25dfdbfc, {0xf}, [@nested={0xe8, 0x38, [@generic="59c9314533e64635dbee855aa9c75d1db1f08b2a60edc929a0dac6bad38b4be6acabdcd549a36fa1df1d0ceb9b926ee137b4415ae9616ca31e378ce2e892a4628582d190aee624eca4b6cd28f832075482d5f2fe644a83dc006b39856b3ca46b8bf9314123a0e4bdd30b61bb57cd5d5f4ee4e79c492bab6be000c20007d97719a08c9cb29f97fe39e6d8baae20955ba8db455ea5619b9866ccc91e1408b58e2ff94824cb13d2bbaa46ce5350b8c26ef8fc361d798b12ced0da162fcd27c316f5adc0482abd49d083dc6dcac61dcf387014b2bba010d92c47d1884c0c2adc72b41d4604d5"]}, @generic="6109cca96225d535c0d1c341267ca992dad034903db77d9c", @nested={0x18, 0x4a, [@typed={0x14, 0x7a, @str='/dev/binder#\x00'}]}, @nested={0x2bc, 0x2, [@generic="08fe95328afab580c7670c359db8cd0b01bcd06819914ee2bf39109d1e510fdcdc7bf9448db92d0a099c4e3bfdf301ddbfb8736c196676b8d770af80a6b66f421a774b7bde3baa5436aa3e3d1061084c9347dfe240524d3d9adc2b39e388600e23cf7b84f3c653e1afae88dfdd94dd96d7fd31301c60a448dc98515cef38cf0573df00fa7f0542b22225eafb2e2ce6dc03210bf9467c71bd7495965feb77b6", @typed={0x8, 0x90, @str='\x00'}, @generic="83d2160f47bf082f09958619b8426776853d9838de29fad2d1f27e216922fd165236d2dc5ac7f5", @generic="361ec4b37a6e6a4523e39fe990a25d68ca6e83dab4233e90e7d125115e531e07f5a3537bf6021efe52b02f8e10f202fa7307d758ab18c8e41d1f75168f766dc0fa456f45effb7056c04db30c88b57621d0e9aba0a5e08f87f4014196995125c6b77ce3fa3295c7254610a5fea94808ecd0619ecdcd3297419aa30741751bb9016528c2f524e9bc3edd9637b681c25d5f39d92d4a0d7198c9baf7853b1fa32a5235ca4253ea655f656d44be221dd5d22dcd410fa0a6dfc42bce6abe63dcfaeb3ec81d5fca5686", @generic="ffa305c9cd51dd2d1542f3f6add05f53702be79c6253fca3d9b87bcb42b42084b6a646f9ef07c344", @generic="eb42bbe4e2fad3768fc69bf00787d6f851f75f", @generic="ae16723cd6ff16efe032ac76a488bfaef56eb96bb98c35f2319ad061e486bba51bf6943bc1e8ce12728bec0bb5da9f63895cd6e27a4e069ee34a0cc85fccb955ad8d77994216221f1aa506c0beb27d3df645e759e9075f87674752da127438042fb97c0e66d427e06c4141956578e01777c470d5f833f14a6fa02a4d59374a98383acb70d039c9cd35f792ddb7c73f9a67a0d01311401e72eacb695e8075a636f1c9c9d8d1345cd2197d51de673c2525b82a3c844b8b043df190475c4f074546b63a4117a54075725c9ddbb88e75f16fdf86461b1a8f7809407bd67e0dde8222ebb0da62b635"]}, @nested={0x58, 0x5f, [@typed={0x4, 0x4f}, @typed={0x8, 0x1c, @u32=0x80}, @generic="7923f1a85ceead9473ac853f1e232dcb88fadf77c1f30d8b6c38a4d4c15334fb95036423259dd048028654d90272484d127e8c832ea7d5f97070c1e1", @typed={0xc, 0x1, @u64=0x8}]}, @generic="7106e2951d2687e845c1b475e2611b6b906bfa"]}, 0x454}}, 0x800) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x10000, 0x0) write$input_event(r0, &(0x7f00000001c0)={{0x0, 0x2710}, 0x17, 0x20, 0xfffffffffffffffb}, 0x18) ioctl$FICLONE(r2, 0x40049409, r1) 07:10:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 342.191039] tls_set_device_offload_rx: netdev lo with no TLS offload [ 342.333051] net_ratelimit: 20 callbacks suppressed [ 342.333087] protocol 88fb is buggy, dev hsr_slave_0 [ 342.343930] protocol 88fb is buggy, dev hsr_slave_1 07:10:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 342.538375] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 342.632466] protocol 88fb is buggy, dev hsr_slave_0 [ 342.637977] protocol 88fb is buggy, dev hsr_slave_1 [ 342.644414] protocol 88fb is buggy, dev hsr_slave_0 [ 342.649859] protocol 88fb is buggy, dev hsr_slave_1 [ 342.670024] binder: 12565:12570 ioctl 6611 0 returned -22 [ 342.692749] binder: 12565:12567 unknown command 536871040 [ 342.698469] binder: 12565:12567 ioctl c0306201 20000440 returned -22 07:10:55 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) recvmmsg(r2, &(0x7f0000000f00)=[{{&(0x7f0000000500)=@pppol2tpv3, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000700)=""/255, 0xff}, {&(0x7f0000000800)=""/189, 0xbd}, {0x0}], 0x3}, 0x7f}], 0x1, 0x100, &(0x7f0000001000)={0x77359400}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 07:10:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e754", 0x9}]) 07:10:55 executing program 3: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000200)={0x0, 0x0, 0x0, 'queue1\x00'}) mount(0x0, &(0x7f0000026ff8)='./file0\x00', 0x0, 0x0, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)={0x2c, 0x6, 0x0, {0x0, 0x0, 0x3, 0x0, 'syz'}}, 0x2c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000100)={0x0, 0x2a, 0x0, 'queue0\x00'}) 07:10:56 executing program 5: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x1, &(0x7f0000000100)={{0x77359400}, {0x0, 0x989680}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 07:10:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 342.972713] protocol 88fb is buggy, dev hsr_slave_0 [ 342.978413] protocol 88fb is buggy, dev hsr_slave_1 07:10:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0x5, 0xa, 0x8000, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000240)={@mcast1, 0x0}, &(0x7f0000000280)=0x14) sendmsg$xdp(r1, &(0x7f0000000600)={&(0x7f00000002c0)={0x2c, 0x2, r2, 0x22}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000300)="e17890e4c5c58f95366b7761665c", 0xe}, {&(0x7f0000000340)="1c16e982e287539c2634e2d7", 0xc}, {&(0x7f0000000480)="5e3e5f360672c8f67459e499c75271bcac6de4eeffc8d127e3253911be186cf62a64f5ebb347e1e088f7c08b9e8240c3fb3bcf9426e25167ee6e234944c810d27fe7c3cc751ba26fd6903d45e4ea3176fafbcd05a32864bbde904a9c02c6bd0dd036c06b3a9813adb7a77c01f1e7bd9d632d7fafec42b4ecb15418ab09f2188e91b6fd4f250900867e8d009722ee5438a2398481c070014dd3002e3d304b7a3e85b14aac2a048479489a16856ac2c208bab6474cb2a7369b23402b3147cc00730ee24a68ffe9a6e24ac16c843abe2ff28aec934bcfdb9321d30bf3c376caac7cf6d4b8b27d8e35ade3aedd3a40c481c66e752fb9f46b4e460706", 0xfa}, {&(0x7f0000000380)="0977fc283e936ca931aa388cccf1b31ceac221fe92b67529ad621d3da83b0e63dbe11cb593e25bd6cc", 0x29}, {&(0x7f00000003c0)="82adea518b647f0e2d1243b6d7a85424f913ad2da9", 0x15}], 0x5}, 0x84) socketpair(0x0, 0x0, 0x852c, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$netlink(r4, 0x10e, 0xf, &(0x7f0000000080)=""/127, &(0x7f0000000100)=0x7f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3e, 0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r3], 0x0, 0x6c00000000000000, 0x0}) [ 343.073310] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:56 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000002c0)="120000001600e70dbeb46077e2d1d71d43b5", 0x12, 0x0, 0x0, 0x0) 07:10:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 343.292783] protocol 88fb is buggy, dev hsr_slave_0 [ 343.298727] protocol 88fb is buggy, dev hsr_slave_1 07:10:56 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) [ 343.438920] binder: 12598:12608 unknown command 65535 [ 343.444396] binder: 12598:12608 ioctl c0306201 20000440 returned -22 07:10:56 executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) 07:10:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) 07:10:56 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) [ 343.707328] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 07:10:56 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) [ 344.076029] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x20, &(0x7f0000006400)) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x400000000000211, 0x810) 07:10:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 07:10:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) 07:10:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x91, 0x0, &(0x7f0000000240)=ANY=[@ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYPTR64]], 0x0, 0x6c00000000000000, 0x0}) 07:10:57 executing program 5: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_cache\x00') preadv(r0, &(0x7f0000000700), 0x13b, 0x0) 07:10:57 executing program 1: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a00)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) fanotify_init(0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x80000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r2, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000001180)=ANY=[], &(0x7f00000004c0)) pipe(&(0x7f0000000440)={0xffffffffffffffff}) perf_event_open$cgroup(&(0x7f0000000680)={0x4, 0x70, 0xffffffff, 0xac2, 0x0, 0x1, 0x0, 0xfffffffffffffff8, 0x10000, 0x0, 0x80, 0x0, 0xf5ee, 0x3bfbb515, 0x0, 0x3, 0x0, 0x0, 0x333, 0xffffffff, 0x9, 0x6, 0xfffffffffffffffc, 0x8, 0x0, 0x6, 0x6, 0x1, 0x0, 0x9, 0x0, 0x0, 0x6, 0x0, 0x0, 0x67398957, 0x6, 0xdf6, 0x0, 0x0, 0x4, @perf_config_ext={0x7f, 0x4c93}, 0x33a00, 0x7, 0x278, 0x0, 0x9, 0xc13}, r3, 0xffffffffffffffff, r0, 0xf) syz_genetlink_get_family_id$nbd(&(0x7f0000000b40)='nbd\x00') ioctl$sock_proto_private(r2, 0x89e1, &(0x7f0000001200)="30a9e5a251b9b92730b8e8a5e375ade2cba469a9f9893e9bd3c34dfd16a76c54153bfb5fc72d62b92a9aef257af8c81a78c500dba9796a809f59135bf5d99308620287981c5ff8bd217e3284258762fc12854ac62a4649d7773bf07656c3d687e9b588912cf934cff8127d9c6cc898a9d5aa8b248b3634b8556325e837cb5decc749c4dba71b7ffc7eb741111d797f3a83eda733b340fca75a87231e9918e44f66be6d2b4382ec11fc68dd2f760cd7a8755c6bc8517f5ef1ed7cca34101bad5fff5ee25c4ace6c3494e4d32012fdd811afbc83709923935fde4eebf553de0983a0c35ea2167f7adc2a39c6d87bb04d80d21bf80cd1ee7488c80591715f5dfb4e5d8a3e5f945c0df76efcdf1c9c49d23e24960e483a776f328b8b917f864ef9fbba09e033ac41a2f6832f64f6b38661be7c43f1038c01da58ef5b1a3b5ea2b2f5036ca67a6a18d62f5da6359a6366e753c9fbdf52db2152f3f1c953d3b9c78d2b71daeef85160e6bf1094c0208756ad05353f6479342cbbdbe6e2c4b3f7139fd62327a0d7118e6d26bece7c4449a0cfc6461265e24823396d7b3af0afecdfbf5ecea5daaeb72d9d45a8ba8cd82b984e16e17ac016630fb18051cd035bebfc390d583f84c998165c3b0225131338ba4dc5dd37d5590f6d3640512345b8b0b8192ddee4d4399af5aede665b1d28653c88114071fb1188020cce642621a64c9736b7f7f0c3184f8dd628c8b952da1d660e4b8f25828042fb5a4e3f6520f689a97e673ba226d96d0dc0ea94d6f9ea0f4a13c6ef8fb81f1cdc9aa86f218b5eb5d15f756b35c8371aba72493758811a78719260638e7d2f488cefaf77a6a415d20a2e18fdae9d310b944982abda6f364966aa58cfda84e78190fbb9825e91d6c7f4aac340309f2ca696e6e675d5083facbf2e179c23034a517b0e0d80d129721edda932c9cdab824141e05aecaebf15374edcd2e3196c04f4010515819830e39b012038cb690cec0f98dfa993cf69702384a60fb7e3630fffcccfb19e280d4adf95a7140ea2127d758f6ab5f7933462312ff39c1b85188879969c08658a7ab6404a8befcfad9d3f9475130837425598b3233fab1463b91598ad7fc3a492ee62f6cac50eaa7281cc4eaf30ee32128633f362bb2e24be13c0fc006d9f387fcc4dc818cdb3894e31ce9f96b9c5e236fa060e0352329163419a268f423b4ec8c9e07774bff0eaa1ee118b56845dac56c3415e") getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000640)={0x0, 0x3}, &(0x7f0000000080)=0x6a) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x18181, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000980)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) [ 344.540550] binder: 12644:12648 unknown command 536871424 [ 344.546380] binder: 12644:12648 ioctl c0306201 200001c0 returned -22 [ 344.662768] tls_set_device_offload_rx: netdev lo with no TLS offload 07:10:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="000096048080100000dc4dfb04a8d3b4446a81623cac5c8b3ca49e74414b"]], 0x0, 0x6c00000000000000, 0x0}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) recvfrom$unix(r1, &(0x7f00000000c0)=""/75, 0x4b, 0x40000100, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e22}, 0x6e) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) 07:10:57 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000009000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r0, 0xae9a) ioctl$KVM_RUN(r0, 0xae80, 0x0) 07:10:57 executing program 5: r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="c109000000002f0005011fe4ac141417e0", 0x11}], 0x1}, 0x0) 07:10:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) io_setup(0x400000000000040, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000040)={0x0, 0x2300000000000000, 0xf000000000001e, 0x7, 0x0, r0, &(0x7f0000000180)="926db009763614e7", 0x8}]) [ 344.903067] binder: 12658:12660 unknown command 536870976 [ 344.908807] binder: 12658:12660 ioctl c0306201 20000440 returned -22 [ 344.973392] binder: 12658:12660 unknown command 536870976 [ 344.979085] binder: 12658:12660 ioctl c0306201 20000440 returned -22 [ 344.987325] ================================================================== [ 344.994734] BUG: KMSAN: uninit-value in _raw_spin_lock_bh+0xea/0x130 [ 345.001244] CPU: 0 PID: 12667 Comm: syz-executor.5 Not tainted 5.0.0+ #11 [ 345.008199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.017600] Call Trace: [ 345.020227] dump_stack+0x173/0x1d0 [ 345.023904] kmsan_report+0x12e/0x2a0 [ 345.027750] __msan_warning+0x82/0xf0 [ 345.031591] _raw_spin_lock_bh+0xea/0x130 [ 345.035765] inet_frag_find+0x1223/0x24a0 [ 345.039933] ? ip4_obj_hashfn+0x430/0x430 [ 345.044127] ? ip_expire+0xbe0/0xbe0 [ 345.047874] ? ip4_key_hashfn+0x420/0x420 [ 345.052035] ? ip_expire+0xbe0/0xbe0 [ 345.055764] ? ip4_key_hashfn+0x420/0x420 [ 345.059933] ? ip_expire+0xbe0/0xbe0 [ 345.063670] ? ip4_key_hashfn+0x420/0x420 [ 345.067843] ? ip4_obj_hashfn+0x430/0x430 [ 345.072021] ip_defrag+0x47c/0x6310 [ 345.075671] ? do_syscall_64+0xbc/0xf0 [ 345.079644] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.084898] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 345.090299] ? should_fail+0x1fa/0xb20 [ 345.094260] ipv4_conntrack_defrag+0x673/0x7d0 [ 345.098885] ? defrag4_net_exit+0xe0/0xe0 [ 345.103074] nf_hook_slow+0x176/0x3d0 [ 345.106933] __ip_local_out+0x6dc/0x800 [ 345.110944] ? __ip_local_out+0x800/0x800 [ 345.115113] ip_local_out+0xa4/0x1d0 [ 345.118883] iptunnel_xmit+0x8a7/0xde0 [ 345.122853] ip_tunnel_xmit+0x357d/0x3ca0 [ 345.127092] ipgre_xmit+0x1098/0x11c0 [ 345.130627] binder: 12673:12674 unknown command 536871040 [ 345.130937] ? ipgre_close+0x230/0x230 [ 345.136576] binder: 12673:12674 ioctl c0306201 20000440 returned -22 [ 345.140360] dev_hard_start_xmit+0x604/0xc40 [ 345.151287] __dev_queue_xmit+0x2e48/0x3b80 [ 345.155666] dev_queue_xmit+0x4b/0x60 [ 345.156915] binder: 12673:12674 unknown command 536871040 [ 345.159488] ? __netdev_pick_tx+0x1260/0x1260 [ 345.159533] packet_sendmsg+0x7d3a/0x8d30 [ 345.159587] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 345.165192] binder: 12673:12674 ioctl c0306201 20000440 returned -22 [ 345.169621] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.190904] ? aa_sk_perm+0x605/0x950 [ 345.194794] ___sys_sendmsg+0xdb9/0x11b0 [ 345.198899] ? compat_packet_setsockopt+0x360/0x360 [ 345.203944] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.209166] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 345.214550] ? __fget_light+0x6e1/0x750 [ 345.218573] __se_sys_sendmsg+0x305/0x460 [ 345.222772] __x64_sys_sendmsg+0x4a/0x70 [ 345.226867] do_syscall_64+0xbc/0xf0 [ 345.230654] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 345.235869] RIP: 0033:0x457f29 [ 345.239121] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 345.258053] RSP: 002b:00007f59b8096c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 345.265777] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 345.273055] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000004 [ 345.280348] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 345.287630] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f59b80976d4 [ 345.294910] R13: 00000000004c5561 R14: 00000000004d9408 R15: 00000000ffffffff [ 345.302237] [ 345.303883] Uninit was created at: [ 345.307428] No stack [ 345.309764] ================================================================== [ 345.317573] Disabling lock debugging due to kernel taint [ 345.323073] Kernel panic - not syncing: panic_on_warn set ... [ 345.328990] CPU: 0 PID: 12667 Comm: syz-executor.5 Tainted: G B 5.0.0+ #11 [ 345.337326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.346686] Call Trace: [ 345.349301] dump_stack+0x173/0x1d0 [ 345.352961] panic+0x3d1/0xb01 [ 345.356242] kmsan_report+0x293/0x2a0 [ 345.360081] __msan_warning+0x82/0xf0 [ 345.363918] _raw_spin_lock_bh+0xea/0x130 [ 345.368099] inet_frag_find+0x1223/0x24a0 [ 345.372293] ? ip4_obj_hashfn+0x430/0x430 [ 345.376491] ? ip_expire+0xbe0/0xbe0 [ 345.380221] ? ip4_key_hashfn+0x420/0x420 [ 345.384387] ? ip_expire+0xbe0/0xbe0 [ 345.388114] ? ip4_key_hashfn+0x420/0x420 [ 345.392284] ? ip_expire+0xbe0/0xbe0 [ 345.396015] ? ip4_key_hashfn+0x420/0x420 [ 345.400198] ? ip4_obj_hashfn+0x430/0x430 [ 345.404377] ip_defrag+0x47c/0x6310 [ 345.408023] ? do_syscall_64+0xbc/0xf0 [ 345.412027] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.417277] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 345.422757] ? should_fail+0x1fa/0xb20 [ 345.426718] ipv4_conntrack_defrag+0x673/0x7d0 [ 345.431333] ? defrag4_net_exit+0xe0/0xe0 [ 345.435495] nf_hook_slow+0x176/0x3d0 [ 345.439347] __ip_local_out+0x6dc/0x800 [ 345.443356] ? __ip_local_out+0x800/0x800 [ 345.447531] ip_local_out+0xa4/0x1d0 [ 345.451351] iptunnel_xmit+0x8a7/0xde0 [ 345.455331] ip_tunnel_xmit+0x357d/0x3ca0 [ 345.459563] ipgre_xmit+0x1098/0x11c0 [ 345.463409] ? ipgre_close+0x230/0x230 [ 345.467333] dev_hard_start_xmit+0x604/0xc40 07:10:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000096048080000000"]], 0x0, 0x6c00000000000000, 0x0}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x300, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10100}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r2, 0x700, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x54, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x10) 07:10:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRES64=r0], 0x0, 0x6c00000000000000, 0x0}) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x400000000, 0x200001) ioctl$IMHOLD_L1(r1, 0x80044948, &(0x7f0000000100)=0x7) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x4, 0x7, 0x4, 0x7, 0x2, [{0x6, 0x8, 0x100}, {0x1ff, 0xfffffffffffff222, 0x80000000}]}) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x1000, 0x10000) 07:10:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffff8, 0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r0], 0x205, 0x6c00000000000000, 0x0}) epoll_create1(0x80000) [ 345.471805] __dev_queue_xmit+0x2e48/0x3b80 [ 345.476214] dev_queue_xmit+0x4b/0x60 [ 345.480050] ? __netdev_pick_tx+0x1260/0x1260 [ 345.484605] packet_sendmsg+0x7d3a/0x8d30 [ 345.488823] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 345.494304] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.499505] ? aa_sk_perm+0x605/0x950 [ 345.503396] ___sys_sendmsg+0xdb9/0x11b0 [ 345.507496] ? compat_packet_setsockopt+0x360/0x360 [ 345.512552] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 345.517768] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 345.523154] ? __fget_light+0x6e1/0x750 [ 345.527210] __se_sys_sendmsg+0x305/0x460 [ 345.531413] __x64_sys_sendmsg+0x4a/0x70 [ 345.535501] do_syscall_64+0xbc/0xf0 [ 345.539242] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 345.544456] RIP: 0033:0x457f29 [ 345.547665] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 345.566578] RSP: 002b:00007f59b8096c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 345.574300] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 345.581580] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000004 [ 345.588851] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 345.596115] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f59b80976d4 [ 345.603377] R13: 00000000004c5561 R14: 00000000004d9408 R15: 00000000ffffffff [ 345.611545] Kernel Offset: disabled [ 345.615184] Rebooting in 86400 seconds..