565d, &(0x7f0000000100)={0x1, 0x5, 0x4, 0x40000400, 0x5, {0x77359400}, {0x5, 0xc, 0x8a, 0x0, 0x2, 0x4e, "894dd48f"}, 0x8, 0x2, @planes=&(0x7f0000000080)={0x1, 0x8, @userptr=0xfb}, 0xba0, 0x0, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000300)={0x80000001}, 0x4) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000180)={{0x1, 0x1, 0xbb6, 0x2, 0x20}}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) ptrace$getregs(0xc, r6, 0x0, &(0x7f0000000240)=""/135) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000000000)) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000340)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0='bpq0\x00', 0x3, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null]}) 22:00:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x6808c0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000080)) [ 796.079329] Bluetooth: hci0: command 0x1003 tx timeout [ 796.084733] Bluetooth: hci0: sending frame failed (-49) [ 798.159182] Bluetooth: hci0: command 0x1001 tx timeout [ 798.164611] Bluetooth: hci0: sending frame failed (-49) [ 800.238993] Bluetooth: hci0: command 0x1009 tx timeout 22:01:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$PPPIOCSCOMPRESS(r1, 0x4010744d) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:04 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000080)=0x3ff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) 22:01:04 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000003800)='/dev/video0\x00', 0x2, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000003840)={0x0, 0x0}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r8) newfstatat(0xffffffffffffff9c, &(0x7f00000038c0)='./file0\x00', &(0x7f0000003900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000003ac0)={&(0x7f00000000c0)=@proc={0x10, 0x0, 0x25dfdbfe, 0x2}, 0xc, &(0x7f00000035c0)=[{&(0x7f0000000100)={0xbc, 0x24, 0x100, 0x70bd26, 0x25dfdbfc, "", [@typed={0x3b, 0x32, 0x0, 0x0, @str='vboxnet1*vmnet0md5sumselfself$cgroup{em1selinux\\md5sum\x00'}, @generic="8663e753eea949b4ac7c41f48ebb2165bb5051c16516d59f425ca37dcc882ab0b1ccb91b4a52432f8ba2bb43b85f47adf87b1bef7985232fa97c5c9f60e51a001bb5880ee793c5af997125ac03b029a9b3a5328683b26c89d2968fa4904f4062b5aa1d315d1dac46", @typed={0x8, 0x2, 0x0, 0x0, @uid=0xee01}]}, 0xbc}, {&(0x7f0000000240)={0x25c0, 0x37, 0x20, 0x70bd2c, 0x25dfdbff, "", [@generic="c1801317555442aab7d88b2c59b34aba166a8827dcb8eed4b5d0c531b7eaeec29e9dcc16bac4db28c8620a188a576525ec4a92aa7c45d6a895017af31a1686399e8d9a4dd047f91511d4223c64c42717fa582d3d96ae86282304908e239c438d0e265c795b2d2cd2a8", @nested={0x322, 0x51, 0x0, 0x1, [@generic="e1ab101f91cd4059149e2ec7b6272ad603b2cc9936ca7235eb422eb4d53b3f81b7b8507d8ca4f229164170be368fda4fac4f54fb71a4b6fc6a5cebfeeb6c63eb22ed07179ca404b8aa66c1e272ac602c5a2c5f18a6537ca8ade3b20fe8a5332cd69cdf050eb16198203189ae5d4574", @typed={0x73, 0x13, 0x0, 0x0, @binary="586385840eb6024f07b7014596c7e28a14754da5bc4307621aa17d1e28abeb02c7c56b5faceec40e66fc7ef62b3f650f0631a3c757bd90a1209c201d1d5f017188a1a71bb5d6e34e50fac7c177077d081473e7f930eb70835ac2f7d6386eb5fa328040b330f3ca4ca57f74771a64e2"}, @typed={0x8, 0x88, 0x0, 0x0, @fd=r1}, @typed={0x8, 0x7, 0x0, 0x0, @u32=0x1}, @generic="6afcaf517beec980453ab0f775fa05330dfedee115dc719bec063bb79459cfadd21e448f77dd3a2885c18e912fd529900b9a8821de42d50f37a8ea1bee6aa9e69edf8da68ec8a7733ec97cb279a4fa07093eaffad611dd27e67b63f896ac334f9ff6c848ede02452b8ce7e94d491419d8e290e435f746e4039dc7f28035935e07e108834385fb5f5393e84f70250b521a319def5fda6bd0d38d2db3bd4f2cbc49baaf483fb0bad00c280f66f825831b1d91d5e5e6a43e8773034f843a646f9ce9b038259c6e0274c7d3ba396ae7486e433ec73bbfbe0ca7cddf8e23e2480a17b9c42c1c748481f8e50374d0346bd959ef1", @generic="3957643c56d8e0e11b761818332c4286182b809aefcf4541fbcf5b6b16564641fcf734a029da3c2aea90118c6cab8b792ee6246ab0feda5df4f81ef6c5cd7772cc0e8cc051a9c51e1f53726c1e19c1e49b3a7002e2dfae4eb6e599574baf6e55157073b893d096bd0c8e4329cec066d9d0dac3aac11c45d62e81ee6203753207caa59975cf447271beebd2b25bc4b8e9920cc4c33cab8136246db620de697dec205b4dbd0cd6e389afadb7760315c53e2158d21c26de2658e382d67ed3835027b0d2a88c06d0325807a389bb603762d3b1f6f3b510c472a2df159e5d541f11385c15e7de4ec2d16b783988fb", @typed={0x8, 0x33, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @generic="0d47628c6856c4c642b84b7b7dda77005d73f63fe38dffb9c04ee2", @typed={0x8, 0x7, 0x0, 0x0, @uid}, @generic="c30304b47226e9c55ed6f94166875fff24bb1247f3a59697052ad66bf2952d8aed6962"]}, @typed={0x8, 0x7c, 0x0, 0x0, @u32=0x80000001}, @nested={0x2018, 0x3e, 0x0, 0x1, [@typed={0x8, 0x47, 0x0, 0x0, @ipv4=@multicast2}, @generic="e34ee7e9c6dc26763270c9deb1abecee52f3a72788dbb1d655b52beef13421fc191ffe5e390743042479ba0449f02e63ae21bf21f97c29dcc19546f8453bb7f35906752420c8b858686c459a46c65baf2d6aba5ee1e4cdce12d04d28f094fdae932eff9ad2e242c6b047f6b81c3f90ae8bf8a62ca52b1a876759dfdc146e0eeb02feb4294eb25fdd9130edae18c1129e53d78fc9a152914e0a126d12630bcc947c66c5ba780bf8d13974957d47771309d84b3dc003350ecbf94e477d9be63599f637d94e8f6279fecf2ac9d4dd612ad5e2466e3914d658bde380af69f01db70a34090052737a62b56e47a40501764312195bcdba60d97710a168902cb1ab7555af522faadd57e00982412493bf58d858c60b6c074ad6c5aed0cc508af17c78ac4064a9433584567fb04493a68ca25802b326b4ade85488a211c8c1b3bb2fabaa0d9747e2522509b85df256cc50ad6a2e9fbaabdfd0290ef6b3344ca8f95edfed78c29280c245341249e4a570cbcaa7544e63729531a598a9ce268dd2b60c030c26053cfbdb94425154bbf3c2203fa5683df4895d57dca8feca9fb1efdf62d554ff816bde0228770cd09320b8665117b5be13300dfa63c4a340c4713cab7405064ec83ab46aa92fedca2d56cfd466015b2e1746bc780cf0ee9afa6f81ed48a61ec6222f9d24338d906c7d0f87c025d79eefcf1e1663a88fffdad7004e31188a4039b249915cd2dc16474ee310c8031ec5787256335f4f7dc9cee0181dd525e03857eac77f4e3e7c5c46d5f727f6e411a5372dcd0b3fa2afeed2f8930303a1794fe1611f9151128bc9275d4c5c3f5f56a612aef19cc8b0def3938fcc56b8bd7f4d7c87a472bbf69f40677c12fe53e54c32e020e91b5c731b8ac874d296a4ecc6c1734cc1ac9c75a9bd23882ad7c3e570b12ee6273677047004e69ab339fed833ff6eb318a9251035116a0f39f8b63a1102bfb9e04dc2cff789dc1dbc114d63ffaae4bdad03ef3d2975ea367d8e7b3b2290fef4f4dfe085319646aa0a6a3ee3520459e340956fd7ea811e88a98743ffe6faf556ebd0efb58198a2da8f72938cb95405b58a96225c7ac8746f5548c54422628b76734dc76a9dd6658ecb7ff7fe9c14fd51c1e696d84e4df497b5f57efffac27ec624db56a7fb60dcf53ee744adee45af37804186a1581e3677fd957a47b493abaf1b7f6ac8222c31b78afe08b4b406f94159cef4a9b96034b7238bae91154659e98fef4980a46f0cb707047acc918d968a641fa0b2f3ccce5b1b5f39fdee7ae728faaa002517ba85e43ce6066e8f7d4875c87a5b81bccef63d6704e66907d2ba1a92e8d23407e945b7b8325795278ac4523aa292f7e2406d828d87dbf5b74e0d5753dfa988e7f79b7809339b7e4849963befd07423d685523a6c2aaae44c8ff8e240987118d6b421d07888e91854e57c6034edf866c2512cc392f6c3ab42786736c284f9e6ffba8de6ab00bdcb4a702ac62bdef7f7576804bb5e9fe5f859cb2c430e39f286c7e8486319a33d251dc1e4ad63480ee43868ddeb7dfe0d1b4cde15cd4de4ea15a132f637c52fae0487ed46f441775247df697a15c85201267a2c794f74b91e717388414dd5f8b18ec96d302069de2dc5dcea4404defde88b71c9bb6496a3c250a1c5c4615f1e00b24cd0db06ba4bbc8bee3e18d2407b455d14a12c3912912a3974505dc39320c166b7835a5e8d4ddf72756e6557b60b18a3c808abae6d9616ae81aab540183274a2b62b9bcf03ef5452450a80c64fcc180b2f762fbd7167d4e427bd2005736b03dde3ba43118c65a8a72940c45ac92ec3fb1a149f5daef7bdeff09e6fe8d4e059c35527351539b2c2225ceaf10b74273ce05b49641fa60c63288e9e120e269c8238fcb2ae6cd87d11dc07e571f1eb5ca324201317d07e52fe907cda426d5e118bc76f51939f63704064de16a24b808b73d0671364ba4208e1f01d44f84594bf509e3b777e3a350a926cbf671ff64354f7ac50483355fcbf862926b9e083eb23aad7d120003ba51c451b6ed83cc2f7d966b446f77ff6862414dfb820f6a2d04930f9630ee38508063ae49aa907804f42b2d7ad106de94ed6ce84e182256c5c30d8aa315f930fce0e49097b4f06d09f512f631d9e53957a03156b0dcbefbcac553aa88878ecf838cde891b31efb880a5ad50ab09dd5d5f95f9aaf906ef87c8d20c4eb86df66d90040eea0305e20fd70b0d51012637e88f5e33aa91af763fa3f0fa68429f18554ef1a2f3aaee0d87f39d181cec8f595ee054a96e79128b5e97ad575f70a9d744cbe76b9c0e2a99ed56322bdce3fd78756245d57401e6cfc4e4c3d56be4092d990983a003958210056e57ab8a96967bb8c742891595508cb39998179156e35f6969d0aa3be9203a45e82f83ef6b5e6ee4d1f8f32e74e650f02f1a5deeea28cecc06ed96cf3493235bef4d26faa26dd5d573f2778ae6cdbf6dd7900d07b45dd30d6c87c9cab6f2686046944bc4973edc329b2905eeacf40b165efa0047c33f8a50de0368f04aa259d2f38f2b24f4ab4b2ff8963065de111e18ea8cbc18c8e0bfc6222d9d10f1ef5c6ae88a6c38df4318dd47016ef6f4ae59f392fe5538b3cad3381784a3680b39abeb2c6571bd6fb58aff6bcc4ff56f7cee64ceb3cae65890b062254aef1bf2855837e183ed18f0baafa22437c66a95f519272b5bce513f574edc109e680b32a0f777076881eb108a5b17f9cfc628ed76b3027f368b2b55c18d4940a8505983ec7f9b6953ca59a28850574e99b9b2099d57002700dc0ae47498652be5ff310fdf0b1908d6575450106462fc94fc989374177c97e4571ab22a4179362d19438158cd2393171ad21c478332c954ea5c2644fa97227141b8d6a73286945f8abcdc30c02a83f55544b74b3ef2b32f5154724a0c86e7868eb165d2d3abb06c447a007e99230d15aa36e9cfcf44a38f15db391436222df6050f5ec87405be2b9206abf50b63e8b5e4870299042ad858eb5434ba2566a070000a34ee751e7c3a556b274f257f0a7c0475f035fe00082ee5d822e20d1119edd29576f7283fa62321c9607804e03238bcdf77673fde2a4448f9aaa8e09b6801c0d47a28dfaa199cb36116eb0ea69f874377baaf206d9dea06c96c1f4b1748c0a34b0379dd2c4eba25c7dc937aad4242ddbff86cfa0aaaf159f127cf93ffdcee323b6d7db96df69c98822ab37975d4336efdb12dd308cbcf32be940e0c66cbaab861b57ba0fd037390c38c609ae2b6a660ad17358c148f977dffa32d30ef34d1d43f7d861745d059fe85e7a5a5ebd40e81311f3bb857ae27e72b47cfdc70b31a2d6e84ccdd2bdc6d49cccd91848cc679ba9c4e2b0b1f3ec40a4f0ab70b6a5df90db7b69ce9e23e415926069e9d28e5dba504a5801e7db4bca0238c45581ffbc684cd56affc203d954fe7c77f5cf59b7626a1e88fc46f31052a1667ca7ba7ee8761609a5aaf5762cdac443346840cf0e9bf208a05284b66699212edf54fcd5a5a7dac186b1155a87d05f94eb4573c9b25d9a405a31bf1640514cbccf5baa60900a40d1747490a99130c8ca21f469b586ec952c5b895a33dbcc58608ddc5e8ac5f6eb4cf3e6713a11c18c69b03a975ca96046afa15c2ff96cd359a60d360b1f392b15521af9aa7fa8ed88dceae4639c58c36245fe1f903dadce2920a0f223dc02b29335b60b4fe84b76b788414f37f87cdec49b617ffa680b6c97011c838a6fe0822914370b1af7eb980e67fcad18f5fb33db4f2e58fad018f95cb70031574bf749d0ad7893bced9f926b09215686525a5fd6e9d15f4afbf5370890c0da18afb9085857a6c95828ad31bd60b732e645dd30e64099e7577a04e21e10e68bd348d00e3f41f0f139485bbc4b96203645a396ec06dd2067b19849e5528eb5bc5712a7dcb409b2de2b22485ce8543c1e5ecdeb5e02b745725734ee21cb72592baaead1943337b9562bf4fe12ddc610784557fffc71963ef9c050da7e574e5e62ae2367dd117d4d73201b9bc95123ddb80a304d152a9b21bba45a9448ff05d62ae1317f7c79392095fefa0736f1d458384f6713f18da612e6970bdb7760f76907bbf2a403f91b56704f32a218a55d0acbaef5d6eb539d6df953136ecb92403a0ba166123f2ab3b0a2b6ff700158d7125fee98340a5ac469fd0d9f6b1247e707e962b7f5314822b7a41c11d09203e1a808a77f4b63cc3a0857bc4569522168d16dd8c5d6b8ac500f380b3c8f974387fab91a300221599843d7cc84125ef510eba236010ce2c271dde36b8aec4761ca8385150f7412fb3d06f8d23c74e9c264fbf69d47430267a7623ae8840fb264ffdb99fbb986c49dd4893e0c918d2040bd1b0d4debfed9bdf847545448203a134294d12c6181011e6caf0c89606de785217f87199b3b8de69e10b264358b5d1321f940df681e15a8d5c37bc8dac760967eb0b7c2145dff3d808d8421a9cc68e0113201636452eab39a788569bc05fbbeb29416eae820eb3e6e961878fb00f7a87d249ea8fa2a758529d241e064ce9922f9c9363cf14ac74011cfb8e55915239b89363ee1de96b9cca9a2b10c287e679320653278880274770445224ea8dd77ba1e16ea63d3f8b108dba90a092436ec4f43b951041179d3cfd12cffc56c177e67176672f59161e2cc94d128de60c2f4d821a59c34cf17cd6aa1065f217f6e314a7a96e13c7a772a42018fbab4ed672dc34b8bafe1ccc7c5068ec6c386674ed9b661f461b1e3d805b7de5ff9ec9d2e73c9c9feebe3d33e350bd04ada2ed1bd553cc140de5404f93d452b1067e7525656d06c4ca42ab1fc514c622bee70c6eca426a7f6f60ec211cf967c7a4dd4fc2824b73f73e025ca426468000e99a00585561f9c6b9f4737fd4a8760293b720d43fffc7ea706d02876a4afa5bed13be89bbf6d7a31189d50e3d76e53f767c3c1d0761a0490f23086e28fd42219f2e3ae4023c59eeb14284e735611e5fd9935bd7470b8f42ab75076132365b97e600a79268ec361a3a8e9381cd49738ce399e317f5f666f00c829eac2a9058338ed3aaef2c5d6802a4c1b7f32e40772f9c2a48ad2909a1be86fa61233247a52399bf64384aab5bd04a5e0e4ed205e4966934899c543e9a1032b63bdc69a7795c1ca84d8e5903e4c4e14fa58e6397212c91c17a3bb7fba37b8dd25980761e5a765f9ebf605bb55ab05475db0759a26d6a0387ffee62d6242b444e10d9ccec7ddd1cf96f5363b664b109f42a6cc60d0170c97fa0ded0a789e23843a82c5e3e997128e70fd6a5620f6bf876fee3d1f79722186ab0348323e1e31f42dfb4f2158fbd71810902ab1874c06f4578371952a4da783aee9aaffd659b5d5fc4839b2c5a8fd769436b51ceddd93d2b27beb984c38fa5ec4d81248888d97df9a34005ce566f1b493b4541ae89daee2a7c0a38e52a7344516b81686e63bb3a2d41ef3aae84d94486a81028cafb0054b429fc43bff245c42bf2c30d4ed6f0f08b65ab7bcf28a492bff60172d5a5014f8bcc4a0932e48bd9f2b46cdbdb2e3e982e3122550db7871ea9c85d506fa5118f4579dc34a6375611ae65224c906e15be61325767c28ec9a279fced89d8e56a36628b91353ac27d7bd6dc56900046536f47381dcd8311af13b69b76329ccb87d788934c00b0ffafff9e1c6533bc26d9ae9386c408982a560924d98a76fd9351540b63ecbe59dd349ab1439b4e1f0fb2d2bbf99e8d99638e648893440ca9b41f8fc0df993c112eee36f84d835b19b95e463fa281f9a3e0a0a36", @typed={0x8, 0x2, 0x0, 0x0, @uid}, @generic="0ce6f9242f6c500496f7135c1b295d18e126c3a734675a20ba18f6f46f86961b9075cf19bad6a8ea303a6c6ce272fcf3b3b3695fd4b75d8eb5bced7b1190d8e5802c9f851977d3083ad3c8c4afe15637b082bdad79f6e5004051920a9f04076a2b9f8c97c52502e951ac4005c42d0f60e11d0d5288bcbe62fa55c84a958e5ddc940a140a41d17014424761dc46e5aa567a1f1c7f7de7432a6eccc945159120fa95c2c6e834aff78717c9b7012e86a80aac4b898922bd8a1b2a01960af4cd63fb698e7032b9c74e5f7035d987dc1a8acf8d88b08311e7abd05f95cb5c0090a61dc1fc562282d6d046e49ae1e8aff8f7d0a0a0444ed7d2d531a7d07b1826b59d2334f1611627c13c2d2c82e79b05ef50dce70c1b8b33a38743c0d1a3958bf8a6d5e76bfc3a3a163060806a76f1ec30ac4a6432ebce04eb7085ede952b8f3f60a54d2c0768e710fac39454e59066e74b5c8e1796c90c60a48b00d12836071f1ff0497b8ef0888fd91cd34a78a0725c4d5d744944791fac890c9ec13479a83c3c852ce387a1d3426a40f48701a3a973a2bd7dbcb9de094fc36548f40b50fc11df467a1bdc45682b825c2f2569a5c1a8614bb015e54d81c54710d479da88d67f00d4ce55e1d683ed319760eeca19ce68d86b719056120a1fc81f2434f1300c7010e961ef6ca65d6275cbc977adc1664d03b532a2b1767db0cf440684b25d5231a995b766df9b3518bd8825d2898ab92278a26961f5c65be89bdc9015b7ccad646163b0e3bbb9ada81033da9642ab1e572f7544e0948b29ab3a45394da0e9d6d293fcef7e4bab3466468c4e9f6990c6a30538c4358c3531be41d6f12e44fb68549a4c2afda9e9cfc160fdea7216f9e8ace0ae02b5b602370e31d4be52a9cfa8dbcdf654d13ad0168a3b3c004587f2a0c80b67b0538974fd492b559cc36eb2cca6f1fac047a51b65868047128570564f11755a5e95e6a3e4c68b9651484603a6121f13f5b8df619fe1e3ec3ba87a26cba7650ee6af2b1a524fc3614cbd736362b436a1ac22e0fa3f11111c33aa42b5ae5725788b63a76484c1a52ca8960bff2a885cad115f0144c16d2940b091f4c535ccc2545a700f71c70dba70384f3328c78f622f3b50652162c0ce92dffdae359e56016a3c4bebecd82855162d375c12a428b90b950a52ccb896afa88ee75c3bd9665fae06f3c3392861b950f94650ebfc10853887da46fea1557114af1fa7f55a5d6268bceca65d140835acfb04ab7fa9730a4f14b27959a3aa1449eb65c1c882b3906449838e2b1edd928a1aa5611732016d4893c7cc6095e81cbfaa8253d5aa07f380025710a17c1a0181283abb87656f01bed5ed867f33cde36ed0d9e8b86fe36f835d3a21ff1e28ee72bd60222262f83c81f27e510e5ccc80b7e85e611cd71561b46e65f0ea49f2866a003efb4ed78d9d9f8457b90f80072dd442024bdd979bc41cc2f69c930a087e0dca8b1adb34469180aa3c56835f08a52b5f02690191afeae3bf81626f313adff2c7d12daaa5af3f7349a8e2395f5de42e8dcb08b26fa7ddebae4680d07d87dab62d4134be6d72fc1704e68ef851d5e9ef2372c10a1e74b2feaa8da092d74d32112a56ec5559cbc1134c78a65405343c00433dafc9c6d8e84f3fb94da2f4edef4d979c4f98ab16a08fd2853ec2815569d119743637ca473a317e1ffd0e1ed7cf0dedef7dcc3a44542e7dbc30d072ed07fc034f34a424560d04748befcd8d7592a1c18a9991942de9c464981a48894954feb83562c2fa6e6ffce58bf34e4788122d7b57013db3c91021fc03715660ca3998ef70854a504cd7fc357b0b9dd61bad8f1c8815e1efa6afc9c592683c74edf4a9b644b1e682a955882fd556b8c31269e1e8d265dbb5c8519706908b91805247039d1a96dc01db17bae6e10d770af47a8cc499ca233abc54ef4aaf9b523da6d89b4822066a7b3fc74697045846060c46223e66ab989980a3fe4f0fbf1363a5d0020ec88c7aab6b25fd5f38657e7c6a4a69479f4053e28fe47d5992860649a4867e24e3c828fefab4b773a5ce57244aa653276a5032485f8fc20bc50eae539ffc6e2d95e4d8299cad110b241954e8a889f2f0aebeee173ea521c6edd5937791bf8e0783432c4524822357e2b329262bc36f94295c94c457a6f3b4a1fc89266447ccafdf2cbb45b75922890cb4fd70625b61d3ab07faa9620badd9cbea3f5bb97a8e69054075c55f3a0d03f79176555360a219d86714eebf3b47f680d3a37553da524059ef3ce1277cbffd078ac58416bc474288596e59af7aac129ff09d7e28c8bc8f007751cf0ec927e5e742a56abbb4932662fd4ab11cb07182ed97b74eab37a52497683d487464538fa17ef04e339897e33c733229dade6fa64161b4cc5088d8344051a00bc06b82c3ea63038e245ab3bf59a235abfb01c99df2ae102d1e29d9d5f8747eb70b4e2a5fbc67e5eb85a116c509eb4e93eabff989a1782e8914b8dd20a07875c6ff8de4eb1490da7156ef471a572bfe32e5b464b886b5448e800cece3da6126dc0e892513b1a01b60f57225bc2dab56ff99d5c6dec9ed37da786e5ea1184f3c40b6767039c99977a4fe6b3c18f296d4a3bf239e951e402abfba5228e77c9b51834eac10d3e9cf2b2b977155b941879305f14978c37e6deb9fbdaf9bc7c7c2b9ab219ba0171e3dc6a92bb7d54494e267086ec89eca4e13b7935f656ad7d8598fe40694e046d9966ac9b89d10779a632e05aa0b6af40b330f42854725a27a08751d4195c550a3b86ca936dd5d71fe739c6c60bfb6326f3ca0ba56bfa2d5c5c42d65633198dde648a42c7340583081910dff5b099d2a0ecfcb8bcb97bfef518496a9b9e81f21ef2fe488d38e007c71045af5ab6ce777611aea8ef7d5043ae2702ae8f79d280a86ede98f34e32447441cb9765bd094fa225003ab5d539fcb90f5c4f39caae0faf81ec5d0646b5f0d5ff6566ae5d84d6e0f5d0109647c62cf6c2edbf935d28b81584766468329e65234015fb93a4260c2c072f58f63642134d60ccd5a5f13d275886bde5deb2f7346cfb27c2bb6df657c015d898023ba10da851aa7c6426bcc865bb4791b03f17f334efd383f1f5e9b711a8d1bbea40add7a56d75445726a08728ed0c715fedc89be0be8522487eda8555131369561f36c5de950329b2588959d7504975c6ef9d615d300753a25e4c486659d975f542874efa8bee98253be893ea90f1e0f14638aec6293ae6188298e608393fc4511bbb240ce21002b613e30c1ea74a90ee9ab946ded181c15fab13b2ab8970b07a90ec91cbbb2c3b4c476205152084b995c7428a9a6df89afa38624927316a7ea99419c0f75d5cd55f8dac351fee9ce57e8bb86c9eb5a51c1ad9a9b12469cd5f643600dc0b36aed6e425f662272ebe3eaf199104ed03cfc572025f29c62b04646bc39c08b860c03229227092f05790287eb5fc3137159ce66e9e100eac67674236d3cd8ebde908086eb3022853035b8b33009b42f01f9dd459eeb2d76d06a6084b59a945170b59383b03804b68327ea624d4738013040689153b442e3a13c97e6b1d9d1be6f52e48bdf162b9e2cc0674ffc74a00f52c6c4839dcea29471a84193464a15f4f4e7a0e0074d8a2228f04d23126f2db0c45a8d70db1770900e8b2effce8c815a320a8d8f47938f11735cc38e48014f4abdc9b21ece51a03f212d8407310c537a2e4d894397c2a803b2679f8b6899be1d03d0db78c2d042246cd968c63cfce6793a1643596ed5a511f0302c1ae967a741ed7ce1393ee74988727687414e9164a134a53089021120eabb2890aab21b471081ec76f90adf85188c068266f45e2f2f324d52f439757269323cbcf74d538f1cfd3e49bac95bf2f30835c52c17513e9a2bcf443c696160b5e2aec84ba438d16413fcd14a6325a406141ca80e1c6e21bd1be816ab0d204aaea81a479be8310d10bb979203da6a87362b488f1b5ad9ef06d6a71c36ed9631216548ce307fdff811ed570c38ddafa2db636f95af268ebd0700f6f5b2f960a4e59495e78df99492645ab744b3641c19f4bf0abc17b6ccf0e809974c05cd4790593e3f2ca87abbf8b61ddcaf117d16233ba7aeacb1372aea7c3e13fc4ca6f3a22c9915e85261c16ac381562c3e1a9a005db8fb37d529a2846304a121a5bf5f38ab90ce1fe3c5674b1b80ce54d41f26a393f1631339fc5e1abcf64f326fc3ce3184024a6e7b128b181a89940f009ec487b906082300574b244277ea9c8c0a2f7e65deec20b6c527901ed7182674625c0dd36628f5848564c46760171f73616c54b98f16a4936def719316da4ef09c0e1b01251c4db4c8c12ceba13c2e8d340cefc77bd3fbbf151f08e0f0b3fcab221b1d019bd5cd83db042178d770dabc60d26635f34dc1e2f65e8ffd57699859774c5456223c8ca957cb5301c74f3313c99fba36b5165aa89c56dc43bece2ad9d47fec12018fd272f280a0edadbeccb66ef7484c3be4d1cf1054dbaed6bb84c7541783a0b7c815a6def31bacde1ee573c1a9ab73ba7c898fd668fd422cb6cff0076f9e59c914d540f028e179591a01eca6c73a660b90ee8bd3aa6b2e8dc1b7f54015f2ae6d7b009b7808f45220cced6dd633e677e922131c780e9d01bf5913cb6353b7f0ec663d6f5829d8d4b407a128958346b8fc06d3a79fcc855643e7102a52f684d0c0118d98f18d1ea3d069de88760e774d4dd2138b0857de1a29fae6f7d9370fe7fd3100031043b924b044f0561c92d0ffb0541161ccac784565b8bb4de214e88a42ab4bee41181babd56e149579b1eafc7079d864da64dc1ea969431d8e50d5d57f4421b5828b5db2eacb05187005a1415acfc04252eaa29e34a9f79a6601d2abbbc194084ddd6beca5cc7e8e38090d28369f460f4b7167765412c2598feb9e5a8e6694304cc750f6d978cc9d37a7b8dc98e5cd4ffce8ef0f46082b7ef2c9f2e214b84215a6be2699327a1e6ef8e2329bb445cd725cd2dc85a84d0b0807e6919f7320f73cbf0c71a1b2e10ed32aabff48cefc49f2d69335599318ebc05f4927481c1f30cff5ba897ba58646d3e8847a871b2e8ca02409979837ef6a6d5cfdc77d5570e27ad62caa55f4b686f11757acded42df7c53ab062904ce6c952b21a663728b5d8a6d69113d85c852c1caa36de7790e73ea9ddb2ab2286246ea0a394c30008be2ea125f7508d4ac7e6871a7e1841b97b0336c48b7c5e76e77637338d173d1728439b4684637a0f1f66686cdc37c5e97db49a66cdcac3563e15e5ca8c6f3f64c338addaae733eb597369be93a225370d91f2087290b0fb50452a10d23c9ba5c6b68bfd0add68cce02be9a763b163ec6f677627a726cfd54b74162868c92fa53c9fc9c75787faaa49db0dca1b35a4c0bfca0cda5ac4eae6872d11632c905b86d944d3a1bc80c9e73a4f5828799af22d90a9b047a60d9074d5d8b96e9eb32e7f22bc9f4a9286bb865255d40a13365b09f788d5a79733e69bf1881fa44df489945119d5fff03952697fe1f6ee5f8d3624e0c5d78735be767bf7caf7f032f179e892e802036ec668b9c54acd4bf1ae200e22c49370904117a8831bfbfbe1a661582c98e138a8da02c93673d92da048cd791388a1047bec9d922ba5d488d55568a71356bf5a27269a0316ad39fa7b578efa93d381302a6bd1c9808b4b4ecbf1fa197928e91abd4dbf5daca1cc2a6ae75147a1cadbbaa733c0b26b5ad149c48e6c1f06afec54fd65f02c9c335797b93a4d989a9c9381ddceed3cd66e740b8400dd", @typed={0x4, 0x68}]}, @nested={0x1ef, 0x38, 0x0, 0x1, [@typed={0x8, 0x2a, 0x0, 0x0, @ipv4=@empty}, @typed={0x4, 0x15}, @typed={0x8, 0x0, 0x0, 0x0, @fd=r1}, @generic="dfbbc96442807858f0463e3246d283f83ce6ea81d30ef717ecc5332fcd78cee064098038da632cd05ceb439ce849e6b06b1f9d276883771d4972f53a35a16210f32d7076af94a338a8eb8d3ed1dfd136cc9efad304ba58d79ef60a15b97265e5ed7078f5bccf771afef39b85da4efd4901b77246ac5819dc7de5e1a533407e47e9fcf22f500d92c9ad9531d182342dd50f1405fcdeb9c3ccda7f4301ded3b2a8d1e19f0d41ed04fa4f5558", @generic="540efb90005eac3199cc247a3d6810ba46af3f2c08aea938ea1c1c0c416a006682c69c61d4c7795e1fa16eab4d7f977856555399a2372b932ba529d9ab43f9e5ec2c2ce42f11c26daa12a4c039f472052a1b63ccf08818eded582645ae895897d543bd42e759c0c859bc2c9203bffc2d0dd251645f8474019fa1c8346b41bf424ea79ad3a833665985e970a77ec9586e9b3c847533d483727a00f2", @generic="21d093eb2f987a65ff44e5bc0da7dcc6913b5fb22cbbfd870a289b1eaf262cc88c356930dddea2696f", @generic="1d016261ee941447174da92067ba7ade6fed7623bcdbc39943e5de9990a8392aabe63d0cd44c6ba1ae3db44dca58cd4c6ddffb2f9e71ff577d59b6f475e8005bbaaa7d7fcbacb10147f50c58eca6c46c4e55a5a93ada3bd2fa8df8f9a8c2b213", @typed={0x8, 0x3c, 0x0, 0x0, @uid}]}, @typed={0x8, 0x95, 0x0, 0x0, @fd=r1}, @typed={0x8, 0x55, 0x0, 0x0, @fd}]}, 0x25c0}, {&(0x7f0000002800)={0x2c8, 0x13, 0x1, 0x70bd25, 0x25dfdbfd, "", [@generic="bc3c2a312e4463e4c34a7facade0224eb70b48026f5c6be76910c496ac6caee9384e4373e237466d13be9c2b0e40ed1bedc494cbb26132743225e78924d9ca8b8ed571922cb02de3", @nested={0x261, 0x40, 0x0, 0x1, [@typed={0x4, 0x60}, @generic="55a2f18cd9c10ee61021cdcb6195e6f99d964358af85d1fb6e0f5554667797810e17b3295af710a1c743af9d48c6fd197692e2441e2de469cfbe573e62848a467000d0f71cd42600b20c7bd854202389c53284df0d042f55c3d3ea63abedcd4edfc0d6d133682f18a1fffc6cc6f220865811985020bb90e1570e2e13082f1b2dd83f96bf684e5bbd69d77436b228c3ae337bb44868f84c43829fe6da1b89c4fecfce95dbf13b7a52b354c6c500863c72a9c823e0362064", @generic="0fca4fc3892ffa394ff0e4834977519296e37b9476d14819f2121286b4082be082711351973a5f90e7cb468bfa195cbb09de860081f2dd103306bbb8fe4ec014a2c7f4cb45e72a8952d79ed62d41d2a62726c49c33e41612c50eb3b1536b8909c2c39967e0f28e4d937f24cc622bb113b706148d6570bf86f452066820fdbe68a0c98bdf4b7136d2545be42504077c655fd84707eb7de673b6cf010a493954062f7e26a83945068899b0c69b899d91a54d86bd85260b3397255df715e7fbe4b0689e1aed5c7b5505c9abe58e8f6342658a089dcfb1b74152aac3a86823cc92989d3965d4c7f10556dd8ec97dc2336026b8211599ac2379c4c3829618", @generic="0dc53f44ba35a6beae08a71503ee55d977df5d11689dad1ef707383860ebe02dc255ddb211eb3d8d806f0b22680381b9351b8b8a6156d685851f3ce92f4abc6219f7340fb545e4d7a15bb2b36998209c781feaca6327b0ce9399176d4b42dc2a0bf56a9aa6d4795229d06239c2f2408676cd568f4bc81366c0737b0848a52db640e92899403d9254cbca772766ea857856d960fc1dbeb85a3a0e9e59246944db98f687e705bf"]}, @typed={0x4, 0x6b}, @typed={0x8, 0x6e, 0x0, 0x0, @pid}]}, 0x2c8}, {&(0x7f0000002b00)={0x2c0, 0x30, 0x100, 0x70bd2d, 0x25dfdbff, "", [@generic="5bb76e18cd2c7b51d440d3faa862d68e3298756264e8b55b2f4a3b2b8f4426c31e3d5fd319d62ea94fca0bbd48b78317d4a6cda8aad4b6ef895037bda1eecb75b66c66905b19fa443acd209ec6a8380eb2f4e80f22b77c", @nested={0x174, 0x5b, 0x0, 0x1, [@generic="a71cecd018f549807bfbf9702218bd845b9c9a88ce74c59c3dd3b8255cac1f4d71b3b22c1d39fe2cac4b6bfde9e15c8eb1ade230676260c4cc187045073041e40f6ccb99d5ec2fae420640e8ed2623d63c1ea9fa4e98fa061d9e0b0833ee2cbdb9780b3b9f57d66482e9de4b46d6693e9119460f4556f5fc6f22e777261d5ffff414c81db865a5c85f719167832b3116e98d8aad1ebd32c36e19d67a65ced91ef068328503ab6010fc6936f135ed0fe08be1a856e1694a2de70547a4480b6c7d4ab61d32", @typed={0x4, 0x41}, @typed={0x8, 0x77, 0x0, 0x0, @fd=r0}, @generic="39d71a41b1066006222a9bc2711c72a47b671e684e5b020e69b6dda85cfebcc49074b69920c9e6792874686ac1d736f472d8c9570a4108ca06161d2d6f64836a4855064388c4cc86dc03a914c8c85d13b854aeb5408c1ec2affb4e90ad854f44651691ec11ff152339bf0242ea04bca2a22825d36daaf017bd70049a8a3c75b74f262d8a29a9d5bc66eb98443b785c730addcb373f7c674366978846", @typed={0x4, 0x47}]}, @typed={0x14, 0x4c, 0x0, 0x0, @ipv6=@mcast1}, @typed={0x8, 0x4d, 0x0, 0x0, @uid}, @typed={0x2e, 0xa, 0x0, 0x0, @binary="4e8886de77af1a06c5393206a42745dc7ce634b868b041d516b19ea828a6c96f3597f3e8559fbeb2b8dc"}, @generic="bd4417dd516ad5892be962a827bb49295535815b6cf0", @generic="feb3045b7378e93fcdd04f74c3333228a3b44fee446b1f58c6a91025987717f8347c678b66be4c980b61a4371f01dd5a373c9ebaf345e069dbc6074ad56af5a22c04f5f99cb4d32787cd6641eac4e0cfda6cd39071d34a1fb18383f4668f3104098d6c01c514d85a0819fcd233", @typed={0x14, 0x41, 0x0, 0x0, @ipv6=@private1={0xfc, 0x1, [], 0x1}}]}, 0x2c0}, {&(0x7f0000002dc0)={0x288, 0x3d, 0x8, 0x70bd25, 0x25dfdbfd, "", [@nested={0xc5, 0x1e, 0x0, 0x1, [@generic="9526546bedb52309b20ef3c0ad244f20959b713d75eb", @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@private0}, @typed={0x8, 0x45, 0x0, 0x0, @u32=0x1}, @typed={0xc, 0x4e, 0x0, 0x0, @u64=0x5}, @generic="3f51ea05ed0ac073705272298a80d7b7b142defd3d69a2f2a310ecb841add495a3fd37cf0e6ec728e68e507afaa3a673abc325c9fba88b2a755016fbb8442116d1a6a1480a24a0ec66c1d4df9cc5312e8fe6344f11f68ccc85ccf6", @typed={0xc, 0x8a, 0x0, 0x0, @u64=0x6}, @generic="edfa28fd4032d55ffa41fd6e284f8f2a0afdb4490d35444ef1c012bb"]}, @typed={0x8, 0x5, 0x0, 0x0, @pid}, @generic="45ccdb7821", @nested={0x19e, 0x17, 0x0, 0x1, [@generic="f08aa8d1f146080ad67b2a010ccd44409fafcb423d079105cef8e1c324a3", @generic="5e939c077c10ecd826c8e63b1bb89b1a534519c87bf2e8b75ed47ff6d979e8d920010926aa287a17870efd22777f54a5637d9589d306deeab81475bd2bc54bf2ea58cdec8beb244b2648ce9931ef3741501783598b8ec63e1c99", @generic="d4602d3f4c80f36dc45d9313d5b84da2f8050dbb62306e303a04787301fb0f0ec2895880cf61602a840c8a683fc5dbc616420967b3409637573566d816da0a53eaf94c129cf13049144ec91cab3194c9eb799c093068cd035c455c670bbb60c3f7bff604bab4738d8aac5a41a772b4a9c72e562c1f6f03ec8dc2603c9fd77e3378d658fb9e5ef99968587d0df90867b3c162a034c945b6d3be1bdd375245e9a598849aa3631e527141dccd89131e2b4d92905cf25ca1eb7e08382bf881acc693734caee8cb96a6eb91db9c6a831299d1626157d14856eb6e0f6b7923c153a35910b5", @typed={0x3d, 0x2a, 0x0, 0x0, @binary="cb5dfbfd13d57307a545ca3e4e52fbe6c1882507f88ad195cb84dc1e2a476fff970dbd0fbb917d2129f02b01df4b9c8094e84f2d067ba06a13"}]}]}, 0x288}, {&(0x7f0000003080)=ANY=[@ANYBLOB="d0010000190000012dbd7000fedbdf2531aac0e3faab9224b992d7200af6187c3949bc220ccf4c962677ae04a4b82e4b866eb0258a3d3430d7e7df1f12648137ed2b16b3000b37c7a9926b6a07ba4b3a85b4623a18f9e526709bbf21a4a3b14bf23c16e2003d824d68e2e6dae1d5e9941fb881a881024ea22644a1377e60f46003c43fb2e0b411ef1268adf3fec678a20c945f88d726aede113a965293d82aa1ef52ecffa3399df379f7e7a324cd21e79ab0653837d14a5f00b92958f8b6dd0530555ba7717b83b50500230000000000c666d911f6972fbc9ba4cc516b4388ed49bff8143cf5918310293e1aa1c292878ecfefd5746c1c2fe2eda06e168c1ee857b44ff683efe9b430b60e78167a96893c5d113f185ee90c64ee1956824ca6acd85798118146041f527aff869b9febafffb4c7f0d5dfee8087eb68b93d624f1ee4ed2b9779f792caf497438efc106a8244120d3534d1c6ff2b4942fa7439b86b53396c9dc58e46464ace40df93c44af2954298e15316bc3c5df590d84f818548aa330abb8f59f15e22e3a09fb272a54cca7cf9f0796490fee6d0bf16378e478f5bfa8cec039087b545590d5c0e561e39e90e73ba6b3453c8578a438c3bce423c7724036f968d47b7485df98cee5d9b00"], 0x1d0}, {&(0x7f0000003280)={0x324, 0x31, 0x200, 0x70bd29, 0x25dfdbfd, "", [@typed={0x8, 0x25, 0x0, 0x0, @ipv4=@multicast1}, @nested={0x1b4, 0x1b, 0x0, 0x1, [@generic="8f3687326bac64df1acf183d74fd7b79ba4afb3aea9741c10689d36ace4ed3f0672e8dde45586198432d6d3fe83e88c1a58a663ed8600eb7fd740fdc4122acf4ef94", @generic="b1ddeb6b3ceb38d83117a3f04cdfe77f08ec3ce7b0aeca3fe0f4b5c1abbe6dfb8d4b5ac2616bb5a6e681b153169764675741c8eeabc48e1e4f043c477a922667c02ea098ac2b6af7e7a60df26a59aa49311edcac0616b77fa5db9fa8f7ccf730b2f6b0ec330c467e291a7287f3c8a6753ef531000ed3a39372edddd5caa52c69d0dc06c19d6b850634d640286b5a4d0cf59b5099ab3ba2d609255aff4c832897dd305c92d93b02278e", @generic="b2b0798cc2a5888c1762d3", @generic="e321f7113d25e37472f0da9e5f5d412d2fb40aba3d640e117b1850d29261b458ba1d545bb9a77f1340886c63e56065", @generic="0bfbdf4988e04ee10225817bddd00cd2cec980df9af29545cd64e451ae3edbd7dc3578f335d0c642208ce2bbc81accd3a65a58fdf99f767844c1eee29dca011aafc415ef4833f8331afa7c37eceba103cd151e000642f0c8a272b564fd3e85c332e24b63c90f4d8585d8c3e4ee7a70028aaee8a75a9ba020bf144beb516bdbcbf23ac66c6a6a6203259faa"]}, @nested={0xfe, 0x0, 0x0, 0x1, [@typed={0xc, 0x30, 0x0, 0x0, @u64=0x7ef}, @typed={0x8, 0x19, 0x0, 0x0, @fd}, @generic="1f295a351857ad645dbca1c71f21f6356c9ac15448ee7cec1c2fb41d6933bfd3b36a0a0c0a45dada0dc6fbb0", @generic="918a11c55b20e20374c76036745d4948ebfda2c8258372e10beda07aa9bfe5660e306c34247b76f1d7dee56479d633f0512d5c7de76f6672c7e7545d9a3865fed85d4c7c4856fc1c01c495ca0de66eabf0547d597b806c4b22d5dc30b79e143d646c6d677a5d338abdd0e657ed47d59407f6e97f508a584499bf03dbd3c4505762376a5564a1ba5f065d99bf2f864229a9f13ae61aab5a9e8a3e9bb1f4a444abf243d57d1ed637a3c3c901b991045c054cfb", @typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @generic="0fa2d672dbbb6c459c551389481d45cf07715bed538e8b2223da524cfb826bf8d372b9aa201f31cc5025c0d811ef611236b7c1b4b8c63230ddb3f0f9f036c2b660c8cc11c133bcf69a3a756eeb18b7328a4e270528828147"]}, 0x324}], 0x7, &(0x7f0000003980)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r0, r1, 0xffffffffffffffff, r0, r1]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r0, 0xffffffffffffffff, r1, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1, r1, 0xffffffffffffffff, r2, r0, r3, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r8, r9}}}], 0x140, 0x4004005}, 0x4000040) r10 = socket$inet6(0xa, 0x3, 0x80000000000004) r11 = dup(r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) 22:01:04 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(0x0, 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:04 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:04 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U-', 0x7f}, 0x16, 0x3) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0xd) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 804.528380] Bluetooth: hci0: Frame reassembly failed (-84) [ 804.540835] IPv6: NLM_F_REPLACE set, but no existing node found! 22:01:04 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r1, 0xc040564b, &(0x7f0000000080)={0x9, 0x0, 0x4001, 0x2974, 0x1000, {0x5, 0x7}, 0x1}) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x810, 0xfffffffffffffffb}, 0x0, 0xfffffffff7ffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$TCSBRK(r1, 0x5409, 0x3ff) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r3) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) sendmsg$NFT_MSG_GETTABLE(r3, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x48, 0x1, 0xa, 0x603, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0xc000) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 804.577664] binder: 13038:13053 ioctl c0306201 20000280 returned -14 [ 804.585452] selinux_nlmsg_perm: 84 callbacks suppressed [ 804.585468] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 804.637651] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 22:01:04 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x412d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80000, 0x0) bind$nfc_llcp(r2, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x9, 0x3f, "e3b3d0565997ac681204567613da16dd6752063cc783857956510920402dc1d73d52ff99cf81643281d7d0c6ce7af39a4153547e32592a3e328eae15ac8cf7", 0x20}, 0x60) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 804.694332] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 22:01:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="361e0508", @ANYRES16=r1, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000200)={0x80000000, {{0xa, 0x4e22, 0x9, @remote, 0x7e0000}}}, 0x88) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x105000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r2, 0x5412, &(0x7f0000000000)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f00000000c0)={[0xd000, 0x2, 0x5000, 0x5000], 0x33, 0x1, 0x7}) [ 804.774018] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 22:01:04 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) fcntl$setstatus(r3, 0x4, 0x0) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 804.833914] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 22:01:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r3 = msgget$private(0x0, 0x2) msgrcv(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081e55512d3f5fc8fc1499dc52fcd954d598271fc62b6184d740353c16304c9e0c831a53fa105dcd6aeb3b2070004ba2db6e9ef9fa6b6dc00ad67b1da90173443deb389b3fde379bcb50031cba8fabde67fb52624c388b537456b18c67fb54ff3b834085b00ed9a35b19f9b483eca16ed1b58e9c5c1f2b72738623862f471022478a96a54254c7b767840d3cf11b8edf228d87a29a034bd"], 0xb8, 0x1, 0x800) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x3}) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_S390_VCPU_FAULT(r4, 0x4008ae52, &(0x7f0000000140)=0x9) [ 804.904018] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 804.953182] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 804.999594] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 805.047616] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 805.065679] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13052 comm=syz-executor.0 [ 806.568743] Bluetooth: hci0: command 0x1003 tx timeout [ 806.574186] Bluetooth: hci0: sending frame failed (-49) [ 808.639425] Bluetooth: hci0: command 0x1001 tx timeout [ 808.644951] Bluetooth: hci0: sending frame failed (-49) [ 810.718406] Bluetooth: hci0: command 0x1009 tx timeout 22:01:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x48, r6, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6_vti0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'wg1\x00'}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xfff, 0x2}}]}, 0x48}}, 0x0) 22:01:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:01:14 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 22:01:14 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(0x0, 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:14 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setresuid(0x0, r1, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, 0x0) [ 814.792780] binder: 13100:13113 ioctl c0306201 20000280 returned -14 [ 814.800972] IPv6: NLM_F_REPLACE set, but no existing node found! [ 814.838450] selinux_nlmsg_perm: 37 callbacks suppressed [ 814.838466] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:14 executing program 3: io_setup(0x4, &(0x7f0000000080)=0x0) io_getevents(r0, 0x0, 0x0, 0x0, 0x0) 22:01:14 executing program 1: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:01:14 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='system.posix_acl_access\x00') r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000ff340b8849d48bb9833c941c881c25934f795222a6aeaced7749bd03df9ff183a8cd10ae7179d23ecbd2170f0c9bfeb8a929889bf033e0bb4ba049685ef82f8da8c0274caaaa0f26f17809db19f3cb9c4b357d545c9e1bd183c9d6598c77f94bea973fc9a4fc6467f14eec92c9ebb7d3", @ANYRES16=r3, @ANYBLOB="04f32b030000000000000000028c8f243a2bd50a7c62081bb9f6d145beb1fe53b00f2a004034ee76181497d4d008f8c2e7000388904f336f53cc70239eefbdf6964ee639e4ecd649055f9d319d8e546cac5f5231190f18087bf9b12e5c112cb656c296cd57cf963a3de5a75381d242e9657101f65af20567bf78f557910e4e3e2ea22334a5e115507942b61d00fab0b44e446c820d0453344efc87e7aec117746c7603199a539d04070586b0aa4e9d1ea546c9d30000000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000240)={0x7, 0xb, 0x4, 0x80000, 0x7, {}, {0x1, 0x2, 0x6e, 0x3f, 0x4, 0x2a, "99e34ed4"}, 0x3f, 0x1, @planes=&(0x7f0000000180)={0x315, 0x600000, @userptr=0x10001, 0x80}, 0x1000, 0x0, r4}) r6 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setregid(r7, 0x0) write$P9_RGETATTR(r5, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x88, {0x10, 0x4, 0x6}, 0x300, 0x0, r7, 0x9, 0x4481fc79, 0x6, 0xa26, 0x17, 0x9d9, 0x10000, 0x0, 0x8, 0x1, 0x3, 0xf0, 0x5, 0x2, 0x5}}, 0xa0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r8 = socket$inet6(0xa, 0x3, 0x80000000000004) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) getpeername$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @private1}, &(0x7f00000000c0)=0x1c) [ 814.955834] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 [ 814.987261] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) pwrite64(r1, &(0x7f0000000080)="9be55ec8315724f222b732f0a7c36e5657a6e628", 0x14, 0x3) [ 815.006207] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 [ 815.024820] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:15 executing program 3: [ 815.093194] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:15 executing program 3: [ 815.157710] Bluetooth: hci0: Frame reassembly failed (-90) [ 815.174494] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 [ 815.238394] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:15 executing program 3: 22:01:15 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) r4 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x5, 0x400000) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = dup3(r5, r6, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r7, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r6, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x6c, &(0x7f000059aff8)={r8}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f00000000c0)={r8, @in6={{0xa, 0x4e21, 0x3, @private2, 0x9}}, 0xfffd, 0x80}, &(0x7f0000000180)=0x90) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 815.277398] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 [ 815.334476] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13115 comm=syz-executor.0 22:01:15 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3f}, 0x0, 0x24, 0x0, 0x5, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:15 executing program 3: 22:01:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:15 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(0x0, 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:15 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x48, r6, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6_vti0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'wg1\x00'}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xfff, 0x2}}]}, 0x48}}, 0x0) 22:01:15 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x691d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 815.669931] IPv6: NLM_F_REPLACE set, but no existing node found! [ 815.684766] binder: 13155:13167 ioctl c0306201 20000280 returned -14 [ 817.198086] Bluetooth: hci0: command 0x1003 tx timeout [ 817.203501] Bluetooth: hci0: sending frame failed (-49) [ 819.277930] Bluetooth: hci0: command 0x1001 tx timeout [ 819.283425] Bluetooth: hci0: sending frame failed (-49) [ 821.357831] Bluetooth: hci0: command 0x1009 tx timeout 22:01:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000080)={0x4, 0x3, 0x400}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:25 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{0x0}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:25 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x48, r6, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6_vti0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'wg1\x00'}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xfff, 0x2}}]}, 0x48}}, 0x0) 22:01:25 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:25 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000080)=0x9) r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 825.624093] Bluetooth: hci0: Frame reassembly failed (-84) [ 825.676976] binder: 13192:13206 ioctl c0306201 20000280 returned -14 [ 825.696518] IPv6: NLM_F_REPLACE set, but no existing node found! 22:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x48, r6, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'ip6_vti0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'wg1\x00'}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xfff, 0x2}}]}, 0x48}}, 0x0) [ 825.724717] selinux_nlmsg_perm: 84 callbacks suppressed [ 825.724736] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 22:01:25 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) perf_event_open(&(0x7f00000000c0)={0x4, 0x70, 0xaa, 0x3f, 0x80, 0xfe, 0x0, 0x20, 0x10201, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000080), 0x9}, 0x4, 0x6, 0x80, 0x1, 0xffffffffffffffc0, 0xffff, 0x22}, 0x0, 0xb, r3, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 825.805114] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 825.860669] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 22:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) [ 825.909181] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 22:01:25 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_S_STD(r2, 0x40085618, &(0x7f0000000080)=0x400000) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 825.955684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 22:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') [ 826.009563] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 826.057805] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 826.092759] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 826.106499] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 826.134571] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13208 comm=syz-executor.0 [ 827.687389] Bluetooth: hci0: command 0x1003 tx timeout [ 827.692828] Bluetooth: hci0: sending frame failed (-49) [ 829.757330] Bluetooth: hci0: command 0x1001 tx timeout [ 829.762751] Bluetooth: hci0: sending frame failed (-49) [ 831.837198] Bluetooth: hci0: command 0x1009 tx timeout 22:01:35 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x473, 0x8000) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000000100)={0x0, @reserved}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:35 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/timer\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000000c0)={0x8, 0x5, 0x0, 0x8}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 22:01:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 22:01:35 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:35 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{0x0}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_EPOCH_SET(r3, 0x4008700e, 0x0) 22:01:35 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) accept$packet(r0, &(0x7f0000000080), &(0x7f0000000100)=0x14) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000200)) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r3, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r4 = getpgid(r3) r5 = syz_open_procfs(r4, &(0x7f0000000240)='io\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="14082bbd628f90db0100008002000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) accept4$tipc(r5, &(0x7f0000000140)=@name, &(0x7f0000000180)=0x10, 0x80800) [ 835.894473] IPv6: NLM_F_REPLACE set, but no existing node found! [ 835.909809] selinux_nlmsg_perm: 37 callbacks suppressed [ 835.909823] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 [ 835.928731] binder: 13249:13262 ioctl c0306201 20000280 returned -14 22:01:35 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000080)=0x2, 0x8) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 835.984144] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) [ 836.031775] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 [ 836.060995] Bluetooth: hci0: Frame reassembly failed (-90) 22:01:36 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000000a14b06bd6b9abd099e194a53137f1ab89b377615b4747cbf5d68e2a6af164196afd5522cbfa1a5b12e6fbee3090c6edf037275295b8a7aea71e4a2cb92f0522169937d4265489ab896235c29fb8b638b5ae7eb63a401c2f49703ca84192a7c9e1c329ba58d6d6b40a962197bee95bf5c8b2a95d55af2", @ANYRES16=r2, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000080)) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r3) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 836.114096] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) [ 836.202595] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 [ 836.266388] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:36 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000080)={0x9, 0x2, 0x101, 0x2, 'syz0\x00', 0x4}) r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 836.310242] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') [ 836.357160] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 [ 836.422954] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 836.472166] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13254 comm=syz-executor.0 22:01:36 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:36 executing program 5: shmget(0x1, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_ENUMSTD(r2, 0xc0485619, &(0x7f0000000080)={0x1, 0xe0, "5e64a54dac2fd82ec02fd2a93996418c9134583876556595", {0x10000, 0x6}, 0x2}) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000140), &(0x7f0000000240)=0x14) r7 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) 22:01:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:36 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{0x0}], 0x1}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 836.755767] IPv6: NLM_F_REPLACE set, but no existing node found! [ 836.794115] binder: 13303:13312 ioctl c0306201 20000280 returned -14 [ 838.076887] Bluetooth: hci0: command 0x1003 tx timeout [ 838.083123] Bluetooth: hci0: sending frame failed (-49) [ 840.156758] Bluetooth: hci0: command 0x1001 tx timeout [ 840.162208] Bluetooth: hci0: sending frame failed (-49) [ 842.236598] Bluetooth: hci0: command 0x1009 tx timeout 22:01:46 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) 22:01:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x0, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:46 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x444002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x20) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) [ 846.770670] binder: 13331:13342 ioctl c0306201 20000280 returned -14 [ 846.832572] selinux_nlmsg_perm: 84 callbacks suppressed [ 846.832585] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 [ 846.910177] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') [ 846.953107] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:46 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) setuid(0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000300)={{{@in=@multicast2, @in=@local, 0x4e24, 0x100, 0x4e22, 0x0, 0x2, 0xe0, 0x0, 0x2e}, {0x3, 0x3f, 0x100000000, 0x1, 0xdb, 0xc, 0x71, 0x5}, {0x1, 0x959, 0xfffffffffffffffa, 0x3}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, 0x4d6, 0x3c}, 0x2, @in6=@private0={0xfc, 0x0, [], 0x1}, 0x3500, 0x4, 0x3, 0x6, 0x1, 0x4, 0x7}}, 0xe8) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000280)=ANY=[@ANYBLOB="000000002163d318ef657cead634efe373fd74321ad0d3aea40faa24ed0af1bb9d012b1f00331f0467625100000000886fae0b2c2a9bcab2fab001ce874db32fd44c4d94f66ccdecc616f605457857543dc5066996c6f95dd89dcd04af53f40dd62c6f4dd97d00"/117], &(0x7f0000a8a000)=0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8), &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000100)={0x0, 0x4e, "14d88c161dbe36b7e592da9d829a9a9601ee95e05e3dde1cae48dab7db54d3fb2de86a1e9d24b0c074f4f14f33fdf21982eec5483ab1c9aa447a5805e6cd81fbc52e3e86757366feb6b928cd52d1"}, &(0x7f0000000080)=0x56) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000180)={r5, 0x5}, 0x8) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r6, 0x400455c8, 0x0) ioctl$TIOCSETD(r6, 0x5412, &(0x7f0000000000)=0x2) [ 847.002140] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 847.054623] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 [ 847.085759] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 [ 847.143384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 [ 847.169087] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:47 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x2000024d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x97}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f000000b000)={&(0x7f0000000500)=ANY=[@ANYBLOB="240085001800210000000000000000001c140000fe000001000000000000000000000000a5cd931d245e2d20dfcbbc5e514e651bb0d3c387af0fa90d90d5f6f63cc31da6a432259ef7c286ea92a8ac7c6509f290579a592eefc8e9b49588d753e93c1995"], 0x1}}, 0x0) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000340)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_LISTDEF(r7, &(0x7f00000004c0)={&(0x7f00000002c0), 0xc, &(0x7f00000003c0)={&(0x7f0000000440)={0x44, r8, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_DOMAIN={0x15, 0x1, '/proc/partitions\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040050}, 0x4081) sendmsg$NLBL_MGMT_C_REMOVE(r6, &(0x7f0000000940)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x70, r8, 0x300, 0x0, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, '\v\x00'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}]}, 0x70}}, 0x40) sendmsg$NLBL_MGMT_C_PROTOCOLS(r4, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r8, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xb}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @ipv4={[], [], @remote}}, @NLBL_MGMT_A_DOMAIN={0x1a, 0x1, 'vboxnet1em1\\@em0,@\x04:%\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x20}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4008041}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 847.199354] Bluetooth: hci0: Frame reassembly failed (-84) [ 847.205199] Bluetooth: hci0: Frame reassembly failed (-84) [ 847.230001] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 847.259913] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13346 comm=syz-executor.0 22:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:47 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) read$FUSE(0xffffffffffffffff, &(0x7f0000000240), 0x1000) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x0, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:47 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:47 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x40}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 847.674242] binder: 13385:13401 ioctl c0306201 20000280 returned -14 [ 849.276256] Bluetooth: hci0: command 0x1003 tx timeout [ 849.281669] Bluetooth: hci0: sending frame failed (-49) [ 851.356211] Bluetooth: hci0: command 0x1001 tx timeout [ 851.361615] Bluetooth: hci0: sending frame failed (-49) [ 853.436029] Bluetooth: hci0: command 0x1009 tx timeout 22:01:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x90901, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0xd4a57b77ff587f63, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000180)={0x7, &(0x7f0000000140)=[{0x471, 0x4}, {0x20}, {0x40, 0xfe01}, {0x200, 0x8000}, {0x8, 0x5}, {0x1, 0x8}, {0xff, 0x7}]}) ioctl$KDADDIO(r2, 0x400455c8, 0x3) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r4, 0x540a, 0x2) ioctl$TIOCSETD(r4, 0x5412, &(0x7f0000000000)=0x14) 22:01:57 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:01:57 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x4000, 0x0) ioctl$KVM_GET_IRQCHIP(r2, 0xc208ae62, &(0x7f0000000140)={0x0, 0x0, @ioapic}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 22:01:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x0, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:57 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:01:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:57 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 857.580484] binder: 13424:13426 unknown command 25348 [ 857.589633] binder: 13424:13426 ioctl c0306201 20000200 returned -22 22:01:57 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x691d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu\x00', 0x480000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r5, 0xc0505405, &(0x7f0000000100)={{0x1, 0x1, 0x28f, 0x2, 0x9}, 0x401, 0x5, 0x1000}) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) dup2(r4, r1) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000180)={'vlan1\x00', 0x81}) 22:01:57 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:01:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x400, 0x401, 0x6, 0x7ff, 0x5, "4b50545447bce3574a565703847d55ac2e5be5"}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 857.644668] selinux_nlmsg_perm: 88 callbacks suppressed [ 857.644684] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 857.680821] binder: 13424:13440 ioctl c0306201 20000280 returned -14 22:01:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 857.736392] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 857.794232] Bluetooth: hci0: Frame reassembly failed (-84) [ 857.801435] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 22:01:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:57 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = syz_open_procfs(0x0, &(0x7f0000003340)='personality\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000003400)=ANY=[@ANYBLOB="1cbd1c9602000000", @ANYRES16=r5, @ANYBLOB="0400f90cf500000000001d000000080001000000000000dc80c45dcbecee077a3b8168f4c2cdca512edaa00702b75ee12863ee610d5f0f9948e46f5217ec85637197370754c230ac43ee021b4837f628fb79333a04c523cc503859cb5e040d34ca1146aa6271"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r2, &(0x7f0000003240)={&(0x7f0000003180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000003200)={&(0x7f00000031c0)={0x38, r5, 0x100, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xffff, 0x4}}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x5}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x8}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048000}, 0x800) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000003380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000a60670f0b718d2565ba91019f49e61ec1e1d3b1c820b7fd8aad0508c7be9919e403b3d224fc6b87e86d63cc46810d905bd28bc9d75935828565498f15d673d9276e24b8de567a6fbe4551f3fa6b21a6400d57d27438b860913430a04ff3bba62eb45fbd8"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f0000001840)={0x2, 0x0, [{}, {}]}) r6 = socket$inet6(0xa, 0x3, 0x80000000000004) r7 = dup(r6) r8 = perf_event_open(&(0x7f00000032c0)={0x0, 0x70, 0x7f, 0x80, 0xf8, 0x1, 0x0, 0x401, 0x482c5, 0xb, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x5, 0x4, @perf_config_ext={0xffffffff, 0x7}, 0x40, 0x3f, 0x6, 0x1, 0x6, 0x20, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x3) ioctl$LOOP_SET_FD(r7, 0x4c00, r8) r9 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001cc0)='/dev/dlm-monitor\x00', 0x0, 0x0) sendmmsg(r7, &(0x7f0000003080)=[{{&(0x7f0000000080)=@pppoe={0x18, 0x0, {0x1, @empty, 'macvtap0\x00'}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000100)="093ed434a7863b0797233ddcbad22aa2", 0x10}], 0x1}}, {{&(0x7f0000000240)=@llc={0x1a, 0x337, 0x20, 0x2, 0x0, 0x1}, 0x80, &(0x7f0000001740)=[{&(0x7f00000002c0)="b27b3d18698658ae61dee6c853d5c1d3559da8e74aeb15a9e0849ab16cefe8c3affe605a264aac43b3f290baf6d588d579e5f8ee0eb398a7edc56017c0edab7f098c2d0ddc69d91092186f7bbc8dacb1d8c8da2b9bb366eb8b98c276cdb1f7e7439de91f269dbff11d1ef5c33942da9a378eda67f1bfca0c1483d273f46250123671c1f613c1033ac3c6691fa3f2d84ab77f1f7f50599ed08e9d05d8b1890667cbf37c94dfcfd79842499b817651856dd2434b95d0c2ade3eca0241a59fe040fa5c73bab2888156d2c44c3c738694070ce8269e614a49f3cadc0c425c6e9c59c2a8c46f867d2a556f5f4092781c6f4acaf494afbd9465be197c33e90", 0xfc}, {&(0x7f00000003c0)="02b479b971374f69cf10f0b90295f99f3be787d308e614076461d8c49780d69cb8f79d1adac040039ef6013acde8a0b381508ef0fc7f47d47936d7e91766b83ec615e07b71eb348dce42b7c71740dba5c739432de64e15e5658148e10c90000d96ebdea55c8004fb6b2de82481026442528c94e160edb3054a597b4b6b25395afb58401f68971f4c05bde94a07c20d32789e1c7952e8aba0bda865d2ac6a4b77215d6d00897dfc5e6cc042b274e6cb2383204947b2e31c49065a6db0eac82859a812ad6fceb62589b93f630088e7b4dfc41ce907823b4cea7e201db2737f0a71d6665986a062feccce43f138ad", 0xed}, {&(0x7f0000000180)="ce807a189a03c253dfbba39730d4807b8dfd416f378ed86c4ef6794c1a0d0a74d74e6d9bf912ac9847d25c80300a4520e1f6a4ec69d0f1", 0x37}, {&(0x7f00000004c0)="e815938890dfdb8c2b44a115c7d726dcd3bc0cf78be7e869443dbb8bf30898f4dc9e469bbc3eca343a40982ea75dcc96c8fb934901d85843775b966da6c44743681135e152d3623494c5f04795aedbefc89a9170eb27f150edee07aa99f7b93de9364140ae0ed3e0512f2d1c2fc73aca1d000bf46e8d3b04cc2955bbc1bc32d618e08f3a16fc4fe938989b3de4e8ea0582b87f25ddb266210a686d4fa30e67254f30e92da3c29136ed14618e81319d3c11d7f5ea37c71536dee01a433f87ad44893d55665755295685d9d7fa00ce5b6c49c9e936a33c03c1fc0ff76ada5b962956250e8159ed4ed148d73ffa3bbc58ef1a93a618121a199e8a18c382281ac58b9624b9994bb5ee64608a000e6f2e1235600edc7c4e2d0a67d223ab73ba1ecd1be6fa3dd2ec389731b3401602e7d59f5b326cd41088bef244edab78e898776dbd50ca908de83dbfdf167f42aa750a261f0800910b7d0acaff4f6e85304a34a5dd2a958331236d778041ea6e4f7e132d9026009cfa7f7524b35cc31b62a9fd0af2923441e69a35c77f32b2786ba1263e7bb825718f48ade82d8e9418a0385016d22903bbe467303ffb026a562155ee68e270bb5622879e1bd25655ab80db86ee8687199a031db06531af30c8c6e4fd30131636a7a1dd79b296560e57d4586d8e9d1ebdafb55a265c4c09aff314b3e1b503d941ee36db0100fb40168e6583f4fcbcf0a27b5af7d63603a60c54106ca63ae23d09a3c40b211b47ea00edfedb3e71046e0daab1b41cae847f6d276ec79ad970b316cebd4e7a35d8a1ebcfef6e35cb19a74d7adf85600d60dfe7be2581df49ca3d80d5d6adca3364cb804f330feaa70e359b8822eb5997f644f1834d0871107999368d0e180cd6bcbdfc75615816070a2f6d9c58384aa95ef4f5f1c2c07694d2ed257e43bff2793edbc81f1e2fe86aa68ced07c362abe27cf37fdbae4f1440de6dbb74a70c59802de90a15f0190e2b5119b2fc05315a7f6c018471db4816510c87920e089158b5325b05ec898217d449f3a571be9e2d62ea2ef24b3bbc427211569ee28d68c04767b576ff96231b060534c36e91f96c38ed0fa1a50f9620310d93e68db2220d0d14e3c05094971aebc4209370fb193477a021c1faeecd36aabacd57444eedb7deab9477d802c95dc33096c19728ab9c4b7db0e1e50aacc724e6ac4e668cf99fff9778a269e73f476be0eff719208b9b2e94efcb8ebf612220071c1118d750f5c06a1af0653e6bd58df673d6097a46b03d8afdd4fe5d37f8723a76037e24172b8e970a6dde8a392e33e49d7eb366807ed28fbe1d739529550872a71ef985ce2cab31ea79af26e2f4f16a74f0ec981483d9c21857599404479f5152b5ad7b7a550edb2f1de71ad95208e340c979a83e58d7e7e5d3718eb0c0928c6e6535b96b865af17f4792848cd2159c1512824abda7bb49d10c9854848bfd77c08ae6f530143f8f43bb22819685a7b8272de9aa63873ebd45ac873491c72d02fac7344d74cbcacdaf7895535b5cd4c8787d0c9e744a03e75a878c8be37f609d7184f8732aab978b943e4668ffa883158828a85e6230a2a5a3ccb2d58d7a2aa9ea92bb2441a6e31994dcca6afdd3268e15c7c2ccf3fe7a40d8415e2cd84546400c429457f47b88df75ccc46d9202111a87f0e30385248b6e7ec8925f6983f9716572546031b3e39d100d51837fd0643d0d2f41e4de6623ef226ec6b898f26d8ba002ff05a4eb4097be8eb9b1ab0b51cebeee0ee5c524b303d121dfa7916d25f609bf0c389bb796b3af05f2a1771a671f7a762897644d034e705bf6e298ccb1825789b98ea33ed5a553e6fcb263afdd162abc8f1750b0814013b4966b97e7912f4a35367b0318ba99c23236094c651021a86b85d37ad7b6f9bffab45296ce6d2a665a0a745fbcb1b95e591dafa6ea849460e016f1e06399a62d394edc8930b617fb16dacb6b70448666f4604af0793e4a3d5a8ed459b84705db8fca97a1a88ef4e65a15b083d1a90eb8b04328899b76dc02a46b3ff33ff939c05ad67034b7e8be68ed7cdca284bc0411e7afd1a7d563e8687e93e0fc6048d2699fcdb3a5a0d8814f250791da9fd03de088ac328d26e9e161a97c45b5e2753d6bbdebf0a91d45c7d23c13261154bbbd70afab19d6c452c374bc258cb76d4655d0239a1cf77f8c0e3e73fbf7c40f7feec72082d8d6893725724421ce127d00edfdad7a01f902012fccd7380a6d5f8bb15dfacf6fbe9fcbd2f8c3de74d3daff9f6c33c1e6cadef27f86dd25f15ad5c93641527f4024ac6b833ce9a5c81c1b0582c5f7aea23ba461451f46d647061ff2dc6250bae46231e8dd45e5c03e52a92d8a32ed29f2121d7b381172a7029f2486f67d70e226f475700671f3f98afa87b90396453c27a8ea38e761fa1795eb8acb8d7706c3d619b7cc71e6114cdf0c452960d1c4bd3d4bd17f4d7a23a3d586e07adcae3409cb86cc2fed4812f2fa8f55e0a87f3eb48477d366f624f50170c13ec1eb09302a7df3bb38cdb8b540984b9dc33986020f159dcf36b736c91d57409a0b576322a61aec5bbd9a3e7f58d95de7ffa25c8dd81acb4414d8277149c6b95314bf7bb65f260c4ad0c01edbbdfe2e20635dd33da260dde396d49105fc7a2b6a8eafa45fd5380132fe6cf5af748a3f5d233a913734170dd62ec20cf6784806f2c05969c2a9115218bb8b01ae5d26f7875f0691f8bb51cbf36133137b60c3560d43f0bd68f77558223f23a4974521da561d45f132c378f461a0d7617c675846ab41175db3f4e3112d7e99c877ecf7f88531f8c7c5e34d07cfcfc887c1dcb75051cb8f54320eadb6891bbca808f8fd8dcee5556b79ccaa7314c015485ec275cc39639859c3673e20edb0699a9035f4b0bb778145e0a15e35dc79a0bb3592e31c07a1d42136d4b6eb00b79e36c9a91ab8886d74f630d54cbac5dc0dc0451132782e25df2a09bf6640b5267681a4b7fea82f91807c67a709435212a2fd3201ce53eaded30c7f56782530a70b91b791b4e872bf5ed23f7bccb88e403cdff1a63999be4cea5a13100ba144fba1072ec48ac506dfbe07e4c4a213534887633ab8ca868339bd01616879f197c659f7f2ef349e55acaf247e4fc2544aa2c600ca889ff7a38c5f977072e8245fe4ddc0064484744c2e070e0b56308773729ddf9ebef216eb61934881a9457fefad14ad48ff2f617ddcfe7d7e2420cb32c22d2e4f0b982114c463c64ea0c020e41a320941e8bcfd853df9dd95ea0f2859d51163b125207e7b48ef8809b7ba16024d5fb207159f2846687299de731f876b4e32c2da9e30fb32651ba900fc5c18eab3251fb240a18759d7a41ede8d373aa7ab4b6c8315793d691a9bb0a6e59ac47b1fca583dca4c6c162365d61b95f3485be8ddd5af0fd24ef3c923817859682776287fbc37ca03219861a878332edb4fb61c231350f47ededac55b74660ad0ece41367622038e7ebe9e00cfba3c1455d886b585ff46d1b9f2c04510ff9b750f452b698757554c8fd1add1d97cb8780be5322f1d3384f4a7635a597cab71ca84843ff744c3dc5b67a76f1f38c04d37539e023c1900d0c553ca46e996674f37c430a5567c47471e6ee3f5ab69589c79522c0bb7bae70992f673e9d9aadd278fc3ca6f29d8950a91ea5b0740fb46c57be8ae5cad5208fbf65f0f3d6bca4a88b2aa9a327f73bbad72cffe187d09575ab7070d800fb84e1280cdaebf23067851dad24ea1145dba177c534b4eb607c52051a763e1cdb00ea20e7540deb449babd280f4fffa1fa67ecac75abb68c05356c4142d0483e8c5cd6a433246788bb2389a6f90762c9ec7cb4f9dae6f5a42c21c704e23ff86109964ef8bd1cabdec8b511ce7760493fd10f0a8558d5f8bd7908ac56fde358e96891baeed8649053831a7d728c4b9f52a2098c3155156f3ac7c8e5930fb91cb62ae05074b39b433f254f47dc50c003a1ab48042ababe9549317b63647c7e6d056314d1368897b9ef1260871ebf5079d7c82f2f50e7b9545aba603020070af44d13b4843bf0a0743bd915eb2d6ae38fa771d20be20e3cdf1533ac9c9565c6cd056464753f840c3444d1e3635cb558b0a093c6c9e259217e5d0c552954507fafb74f701c2f5417da3746a330c1b1cc49ecee31689482ebc8085230fcb5aeb4332bcf945afc5f9bfd711c150b2dcfee029a29b056ef29c09eb966a3f6fd4173bc29921dc458c06c90a0be8a7b635ca43cadf4e63b05ba2f5309408204564425ee268ad1fc2f74956820c50eaf2ede507b44bce541fd086e8f27d6c608226dee1dd097b1416a1ef17b16813865e46140ef82d83e7edf33419c02f96163ada4e7858990e219be1d7b03b638ccf062b9a7d7e45cc85151083679935bdae88303f18f871b5d13d6b43212d0f63c2ab4b436f23910e01febe35fbfad0c164d4ebb6d1f98a852a76fbc5526658c82e460d60b2d395cab82d41379b7adad7e6cb578c1107b97ad69c06632fb292a23e4ed2ecf99784c5a02067a5b58c58e0c1f29701e69abe5da27b7a3c0479252dae3974fd133a6d77d172aea680906d866cc123b5ffdcad84c31249dd8e39521c87ed94be28819d3a98a27a41f229865dedc22d73e61ecac96f4b05698d3acb3fdaa13a643c7d89e777e61db2b117d66314fe20f169f0791838975216ff73a4b606d0139d0b7fa4d5cab2c4114a59748484d582459b1f91927272bebef2064c80b2fdb0dfe1766889b77728416388ccee523ee560291408617b739c59889fcadd94d74cea3542180978e68fc136cea99ebdf3a7dc0ed2d297164c377269ee4fc43e2ae1ecf0ecae0bc8d521e519e57e0eff750df3310805e3dd20b7bcd68ca0e248d1c05e298d89ac6fe4189ba9db5896a53ebe8230cbd3cc08602a6fe9721db79298a0cffb5eb8df1cc25f472e58b4eff60596e1ce6981b5cacab372ebceafa3bc3816afc008181a23e8a561c35fffa5b2cdf48eba9d799ffd8ee3f7e56794ba6a09dff211b501e052b879c1ea125dda0a358d7e96f977ce973ddfdd8ac2d82616f1fc011b0c8b7f872b345b0195dee326dae74f5fa4a1811a57b98d1b55421c3bb99fc50f7a6ef543cd14b3ee860e6dc6163f0fc14a23884caec07fc370d8b6e04024ec1574e25c814bfa844b050b2b5fbbb62dc73ebd2d201ad6a6739ee230fc0307b6d43c55b9840a815133988465ff1978594589fbcfa6a9add2207c724d152a108a7277d48af8eea31e550c4a4f6a7911d8579b425ae9db2739c9b93e1b42f0822ea6c2d9d4cbc6962669b933828b7e4e72c986e3e2551787b1ae8620e235036648b4633339e20c014eecc5a5956f14c427b67982eeb7294cd41356013df384b9ee263f621abf643498843d4756ac010ac58cd013a35cccf47e3a0f400b147f32a1b90370484046e3606df84945e73aa7fbddc9904f91d009c39454b166d1ba9910d0fddf3a239499abb7a2b330de682c86e4da43dd404836a2eeb9c5e90f017a7c8c4a329b6e6a61719799d4edb501318edd8f8c1bf4d361f9f8f0bb11fb7359c2ad6c1388dfe42b2000e82366057f49a2d566cec72c42c973577f193662aff85ad0ae13b246cfeb105aed6bc58cfa8b399f7ad94ffe95482cbe20e9df27b763461b70a4bb41799d5e077357fb0ee9cd91007859f0210239ff14b97e72ad6c6b3f5f7791acb777fda1972c951f5842f69750ba46115a9ac9d8db8da7ee673073eeb43f25f2d3cfc5f6af6ceca77cb207eab9fa0c6b7aead31e0ba2f4daee4dd0062444af", 0x1000}, {&(0x7f00000014c0)="1422d6eeff3611aa60000a3ab83b12f3b8ce2e1d9c057dfde96704f5e4b4383731cc2293f96333c64953ad4a9ddcc8078c7e124c5c1d39bd5a3d3be5ba9695b90921b54b94d01e9d7f11750319c9d84e47ec346fc0eadeb1024d9a680e1446282e638ed7d3e2ece3c2b9674eed2ddf9872477642055e1fa544591c435b129540f6b7fa66ede04da2bebaa5f4366061074eae8132a44c05b1e7a0ad81d65a9af81a9431c94c499bdde42a84d89dc4d5171f11fdeaa354ff169fa2cd", 0xbb}, {&(0x7f0000001580)="fba2546c98981e7d8b26c6b0c95b473856644a1e1e097aaa4a68cd690e25453ffffeb81ee425dd11677809ca89f79a0ecdfb088eb0ee882f98fee1adac93cfd73210103dd83e2480593cbf9a8c08260548ee6dc2a9f6d1343a77f215633e749b471441a593d4b20c1a42259fe087e49bdd840b452224d1ede8ecb4709310645d41fd9f10bc5aa2091e4483e60e4f8917638a374431f557a84f513e3815e54b5a0fbcafb5e47eb5a72586addf162bb7a0e54fecc3b7403da59c86f393b6478811c279442aea2972e4c64b2b283360219b5acce3e571bf4ffce1c81e4b05", 0xdd}, {&(0x7f0000001680)="cac278e6485620594d363fc4303a9cca2efcf21384eddb47bcf4a0929698607da901371ffa2050a9d348b875089c1e5e20c416abecb1cf812d8480965edc0e8e074175a40b89ce07a5d6a16ce3e77543d5482a773fcd0504c8cabf243a2eb2db876b5a100107e99718658fe2250683f0da6c1025f656b1d2edc47c1f121eb4dd7c459004ef3e162a77310e43cfaa50ce3510ec1d333bc21a3c8d30d9df0579b86aa27bbbb2", 0xa5}], 0x7}}, {{&(0x7f00000017c0)=@llc={0x1a, 0x312, 0x40, 0x0, 0x24, 0x4}, 0x80, &(0x7f0000001840), 0x0, &(0x7f0000001880)=[{0x98, 0x11, 0x9, "8433a50eedb2d5fadfefd7171c0f57b1a4706be6d9a0dd542351194ef756764746aca22189670eeef7b65563ed983005906e9961da934e1ea068f412aead550841fe0b5084d92d3e4ee2f35d5f81ea58cfc82a7eae07e184c540151c49ad61ff7e6f4f18a2d5b963aeb39f177b1012da921d23ec3f258b953d6f9555eff7d7afd5"}, {0x100, 0x114, 0xfffffffd, "dc5c408b17a1e2adf543fcd8f288f3a77c57faa55ce8adb8075d3858e37f932ed9a8bd15d43cf8b375457a5a560a42c663ae0d6ae96192459a1d6814ea50cdee2fd042114c2a924557bad1791447b373312ba93a3f634c819d83013a76aef05852f4e9d7318ecd158ad7b051c3c7df403a5604046566e044c5b587e8696972906e1fb2858d9e75caadce39ba95bc74e35c3f33289e8d5d20576db142b1654fb95fb3b1195065f0260798b698055a408da71e8e88aee0bfd89aef799a78b025a3c7922b0bb06685b92f9a04e5df3332df2017c228fd6c4e1e11654e6a9688b9594633d7d4e345bb7a41d635dafe097f"}, {0x48, 0x10b, 0x4, "44fd1b3b08310e3b384df709220af751a7898a84700c2f02604a1cd3d39682408cdc5c559c8a2bc776774a4f3031662d10fa56b60443aa"}, {0xe8, 0x10e, 0x1, "2288e85d4bb86b6f37dc718e3734b17d05dd58bf98f7656f9e481615f4526992e883559cb30d83333393d257c9db63c389852b501a007d494a9baa1e5249349cf6652e3f0c6f442a951b2edc97ee879560d8b69f795eada25a759fc92ba6a48cd4b372005ff09f0f4eff763e7d348ec20c2d21f97a6b641264e6a9a6553bce32563689d8d2ed9bda4ebaf1019011210dbd9af8c679b0829a14af3e5674736b0595e3d5b74a4eee78c86699695328bfefb972bcafd7b0b0bd7a1d80866645e14fc42c91546c6c1b2df361d070d4c0d486629d842f"}, {0xa0, 0x84, 0x9, "d07fe6d86d77ce6bb0edb819e4fe52448a2110a19d6ab8d3d92976f6ba9e48d33be673a909551bbfbbeca0edabb9ee009fd5695ff87eb33baf431e0daf291bae849f3748ed95ae7454a6fbb5e9f8c3e996666adb0b49442f657ed8907c7f0fd1399c1b6d04bf7ff3a93b5f1fd7a3d1c78eaff64c6f7106701d52947e7cc121320cf0aa4a28848ea92fefb3a79f32"}, {0xa0, 0x101, 0x4, "1c48498d63c2c01ab78ffd82dc1151cd5f4ee9957476bbdf137f8319fd68180d439fdeb320d14655c6a8f527036a56e8d0341fa14db3212141a5bf2ba04a9aa78d22a067f4f68aaa9570316bd70b68376462d6cb8271ac6edd98e8ca87d1e1148ba9b5a14190486faf4d21db4ea9d3e173e79df1f47ccda229d564c50c9f56ee837215b686331d64a9d88ba72a56c4ff"}], 0x408}}, {{&(0x7f0000001d00)=@pppol2tp={0x18, 0x1, {0x0, r9, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x0, 0x1, 0x0, 0x4}}, 0x80, &(0x7f0000002d80)=[{&(0x7f0000001d80)="c928c0ade63de134f3d171486959b904c8f520991c1c9bb038dfaabb2972df552e050db3f5d3af12cd0209c07cf318ce38cabc9385791549f95c85ae33f7c450dc1ce52c9e24de401428d2f712ce17aae994b3c6bff07c09e4b2580ad85d37d9ba0c90b8c0ceeb2781acc77dc9038b2aa9bf6b795ac5ae1658312bff3b39b6dc2117a6712a186da19e52645276cc49c8488071d7ad7aa033ce71a359bf7ceed963a6a3d1a16a7c6de81aa1c85a557c8796db4769ef39a8beb83a7d57ed45674bd9af1fda5bdc53634b4856020675bd82cd7ee0a1bafbd96e9d52c61ff5f345a0ec1ee83552cfaca73a75d4810a4881b48b323ca349f1ec3be697338765749f8db8a7cddbc406248614602a2f694d341dd383c70981212455ddfd278c07244559f174af0e9abcf20510305e5df6d9b5fe62de2e28617973e75abb97b835d09a138422c27f7d1bdf7f2405a5cade99769de0589cf5fdd8c0f9ad18e851eabb0976c9c137858e4ea0735553235f7bf6b0cb5736ceb2eaccbe9571a9305526f9f33ed149f27afcbb3bb5ff54579f905782006a84d9668ce2a76a237a64b520d61a335ebcf62db7c0f9244cccdabc66031ccd8d8477e92768137294ec85f8b12a8a9c28e48f698b31de67e9588417ff7b6708b2cda5a984f14d85ce2253bf396ad7934d50f08c0f9794c2392424a733819cfa422daf31a4021dcd82891fa7637d301ea680ae0a4572c65101f2368a75e8e7b5433fdaea3f6ddeb02d3eb6ef2f71fd32770ef9e0932b92e5c79086fea4b4b093d15206aa34df58e3aa785beb4d6ad6f12693994f95b6879da313b45c690a6e5de20da23e83f38da33e9c9b19d585763fc5a1058232df0cb3cb1f6151aba4c0d26bea5a54a22affd852000e4dd15a4bded065eac3859ade8c977a6aad493fc72c088edd77f41204341185028b9654a75e1d4fb0788a6b23bc93f6717684378004c71283b61e33c9ded7a4d7b21a9edcd7da1e3c37b7128f941f5b694efc3c54345c945ee92e394736991557bf51b557881f593fd0c2f292ebd83275ca8c82332014be289d07b0cb6233dd7ee324215affa1e5ff509b216f06e8245179fcdf05c6faeee99e43ed317e8b7e4a24cfdd34c064631936c793d029f98440bd64ecf3cbb057afb4db6c9a2f378daf7cf2ea559db2b9885879e18692597ef96634cf1f61236236e24082f26d34d69a1ad009982704b0e96645a879a10369cc05670aa249c38caa87a35634e9b0f2ac6876f0feb1471bf8f510952f0f09b15e05268758aebdff8d4b3df88139472f32a07de3534b4ecb0d5a92d3912939b74fe1240cf188b6b945ae504b64d1d57b485c318dae49c5fe981104bea61f31fb0452a8ca69340ea8d0270475a7003d50b09047ef7b267d4e0e5aa46aef478af1b4e817d4b6c20cf9bfccb36a5cb6663ce796a1a7b591dc0aebe05d01d5172f0d99e5e640eee88418ce26b9ae9403f26d1c02a3867c2eab895774cf21551bd7109649a037e5e68d0a0c9e2714189e4c4c447a283c7f411ca1e4bf4c6f2ed4535b35e2fd8ee498cb61ea2d5b97af091c78255de364edc6e2d26c7b5507d3f4606b601002b8bedb66df9b29d42458a7dfba58fb76653c1957bd6c3db3353cfb7937f1511d2784cf044dc52dd46879d987659dab70fc787e41574f2302c495254cfc8b9cabeb403659f00a904d1f77d0c5d5d125679a4bb729bc3b788e5cff2ff036cdf401f1601a3420523a3c0397f91f4048d5adf4a93a99f86b55c2e3023f7ba8fdf9d00f1b84b45ac6026ca99e01cc8d7d4a3cbf32d312bd714a37d626efadd7b26bcd21ab7da35fc1091327dfacbc07c0b383c218c806c15086384942b45f5cbb183ff8bad8c2097386ae1758ee302fd0e8fff8c0043fcddace90bafff0d1c217d0fc5c5c94ff453eeb7017d262b1d23f5903588e857dcab2854eca9d972d6df1223de92be8b4cc70b06986865e73ab8f30ed3678223f7f1662bca54e522c2078bce76930ed71077148aa4e64748928b3e33b73c437888ca63f0e5afbd25781cbd17a905e9ce1773990a5f532cafbe6165ca5431245e742565039c7c17b3991da382f09e40f43d344dfcec246af219c9f44e400a3a7352c1562cf6c13a1aa7d466f5c05a3663a2743a94e441c496eae487adc235a6a50c2b459d6fed2d8b81c6fa2572d47e98d576cc2959ba7fc6bf534e4f97c6b707c3b71c5c8ba4611a7c059687dedf62670d6e855fbe04a800410ec0308ba1f3826d16418f09d5fe3e0e517e7bcb6baccfdff998d38ec70652db958b877b2ed399eeb259bed462e02704bb7259af240129e4cf06c33e3ce8f044a7095a9b917d7720b4140d1bfa15d6f0af43067d21d062c4b1d3e76d5449a9e719aa0f967aa4d8e55c7bdb8d922b8d0bf0bb071200b8f9872b901d6bd63174a7ddfaf366856416e4ef38e9778e993355cf61814631f7924826b2b74926fa035918c509d6c233bccb011f7140bbec0e712edbd6b69cfa7f4fa5ae9cb48459a064829b76bd484e5be894a466ee4696946f94af3661d59b35a5b5302794ecf98ae8942d63ca3e570a5c8cffa1f94cb973238e936d659969f90cf76adc95fb36551f095065d2627901fdc2caa38fd1fc5280209bc12243ed392edd4d1c18f9f2b715d3053a6ef89cc8a6f4ad0645fdc1e3de02526da232f91995ff539c3ccf2eb0930fe3ae7b3bb47d3efd229b575972decc062af8e6391d9e1e591ef5829add28d3ff2f42827d65dd3071aadf876c6155db64197fd56fbaa92cc4137d58b3cd38a0f190e09ffa6895a4bf708cc735591853c9f1c9862500a0ddffe5d151ed75d3ec58ce34f8d865ef83be428d0c2e49cc1ae4e74bacd5994433df9bc45797f48e99af628302fa058339b396944c71b9d1cd11aa347ca71665df719f03ba0ae644f5c55f036796240f6b1ab8cca3ac9082988c172df21b22844eaa79ebc6644ed34d27cce367a01cccca6314519dc015ee3985ff20c008d62b763857aee55478d73707de6e06d8e8e964746aacf94685748e0ff8781edd81723f632df6c0b5b481372c51ea24594accd0a25bef309de9aab62997c27deda2c1ebc44ce09fff59c3dd9c36b69ad9bb8ab45fe828db70d8eb7a427afaae2f4d45c6d95539a69dbf3ceb56eb949ea8f9996b8682f7e048dac1e4234b4014a1244d54ab72beb9a0359dbf5d248d6b039c3164e20d01cb77b466733f5f4b56c93b3aa15795bfe145c820d5c4f47db641be8ea0afbb19567325007f44b67483cbf39caed9d1027a7de661bfb81500c9d0bdfb45186b1692534e4c045756a5356f287c361dc1f1e3adbff9ab6d85ede035c7fd956e1bca97b262c00218fe8380522f6c6278ffd8e5f7707a60c4fcbc791e64beb02a9f35e58be8d87bd64e4043a20e9e9e949bff99e2c16e08ab73c2a665e7edff3f1517437a38e81fda89c7839e5257b43b8ef1da76f2f8a4169f6a34f6ef9094a677dcc28c41d9f4796d68fa8812ea57f16bf112ce37eebe7f8ce9e34ae7f44a73ef9b3778719d4f3dc48dd797c28f98bf12bfc70ef96dc1d7c1b67bc91e534a8746ca083c7ef193ea561ac68891aa9a83e79faca8909865a271d1c8cc967bac4c371d1c429ba394ff34c9ed60fadb52c42d13cd23bbd5f20035467efc51985c2f569837c3964a2ba1719b35da819bfb3ae9bcf408272a94d29c4f7dab4ebc2a88aace102d69cade82a922c3897a0bcd212273529c310c6f64ac017d95e56910090d3c4a9fd93d9c1b0969538f7444305f2e5940dbc0deaddae9b5e667b179a947614f9c2a7569ea2fc975ddd8fa2688791adb7b925d760feccde167905b2cbad89d2cb1e0552c8ea3376f731b1265c8ec455d213b5388e1c2e76431e361875ec2ae65379832c5fea6f7abc764bd2757686aa050ebf9b8c99127e8e71264a331f49e435da0b9bf9759aa4fa41e9afa178767d6b961f05c8dda90e0f48203560a72acb30075841adad09d1ff106126d550185edbadb8f86fa7083d372d70a5651e5bc0d5ca7e5aff93d4059e79339b643ceee10387d514597503eec9ed20be67df83cb534b87eaa59f42df318b8d5e013b0388c13e85e3f8fc3006f7482082abb884a88e6879ca05125e93fcd71229432e10b77ba30f188e5a11bd34a117ac95c9b75b0ac9f17d535f4701f151ed3e7977b3954ed4c1410c7701db9aba5c68f94a433b29dee525f9efe605e4396fccd95aaa18324326ac5f17b5fa07dd7d9d28068223ae91a13df6f30132b064072002bfab23857f9064b716279ae01af52ac566c8fbe2a99c419934358ab87496a18dec0e678ca40996dc636c3ef3683bf2fa08f642a530b4bf4c5fb438b79076c6b477673cf814854329a57ba705ae8fa6cd134acbd562c78cec4cf0e5b7b3566a30574a5731c4615b787caf3cc2305f6843d8a98f64cb77ef52ffd6b0565308ca66a5587e95dd540d44cdbd5e6bfbf24823c4add44cebf8be33eb49cfdd07f5d6aeed89c17aca25d8eb0867c582c1f098ec39989433b407b2d3a673c51adcbad75f4465879c8d3b9bcb7c243edca63cafe60324959725716f2a370a2d13325a193b0b717964eceeac1b44b0fdde428f01cc692e6fc12fd6ff6d0fae4b32fe21c0a31beb17306a9f8b1aa48e5f982c7ba2b578d3a5e52cd62e06b4ad847770bd5db256147fb50780fd3f65134c04bd26614e17beda8692f7d18010d9636fa58e9881be5ec9565b6843db7bd5f757eda9ecb3de5dbab67c40e52e991f371e5080051d54bd4fda95fd5325feca7f56ddfd89897a3c7f313c605ad01220aa7eabdf01e0ba55152584d040cdfb0ee6f87788687191718985ee1e02bb4d9ebd6fcd21c7983c22888205e368663b2980fc4dac5bf409ae5f8bf824246cbf0e053fb65c54d4da1a9b1c09c86128d7943db23b9b22b7e30fb9d22377e13b0d5c55ca6a053debe98be5d31d09696c5b3e017534b405d2bfb300e1ddb7f4be79d8acd4f16cd22fdd20a913d14865597fcde2ec4aaab78a5a76f6e022e8f3ea62a680b0866af419690d227aa76ee3a6078f473fd4d9b6a8f6913e5e9b2d7aed256bf8857389ffbbf92ff11dac3e56e9350ae041ec42b79f04e20d5af7995e36dcae865c5e0eabab5f01e23a46e0f7fb56330052137b456ce550a0f877d696885b8883f3ed7e8b7598e2c8243bd23cbd3c501412b99dda0ad7fdfb46da431d9f8134c5776f3e3cdfd9cd6a9e0b3148a836f4a36bff74efdbe307f8eb4991cfb45721e03453b8ddb33e60e024ec539ca11cfbd0369e1ea02d7e697e6694f81a60ff87eb91ba0502c81061a4962730bbaef86bc750bcb2290298bed8d0cbdc3c55b52a1b096b0a62f35c812dca07b6a2fd253f5b6dc589580cc872545d1a841b0ccd44e7bfa7210afbf0e113831cbdb4700fa18227ed3551f83dfea548eb17981bb035a37999ed14c1196ff62b4d4849bf9d23493b14745668ea68f121f4acac6697813dde63ade5d28a1b1378f983b303c53c46b2d700c3247f04e70f1175e7aba8daaa7110712e9c816506a8797416fc9ba88c40194ecca33472685a1b0d534c97a0c0b9a1521f9869a05357ae1d1f9975798bb3205bf11b3d9483e6def060e1c86e12f4ec0491449832e28ee89cb7cd7fd678bd32dc4258efbe921c844724afc1c6797b159fff5a82938e0337d4c5166ee57f621a2377933999e792b42aeb084db5da9572844b65252140deb43342787e352769b5c7ff6ca2bb0d25ef2c23620b2b7e11ca1a5e3226638f5d267cacf3a10bf7235bc9d8", 0x1000}], 0x1, &(0x7f0000002dc0)=ANY=[@ANYBLOB="68000000000000003101000097ffffff5583f459b2abd72e9fc0d4751951d3e24107c29749f73ba7e7a43489937bc36959062c33796d88891a37404981fc3560ed6d15a946eccd1dcc1a2c31a27e8e7df41bef3bf01a7f4ac619242ebfc3a1d5f400000000000000280000000000000010010000d48700009971f6895777e1acfc58f1237b76fa4bf00d54fb47000000e0000000000000000a01000009000000c9c7d6ebb614c9c1257032717695392b59657f24135602ca653bbd52da3ab8e2cdefc0056000d6d93319efa9d6577ed968465474474a335cefa157035061a437f2c4fdd222fdf121da09625f2e6d1e0c896f83e89a995e697a21937a3ecd82dffa798ccd3f5edb611c306a47dc9ba5ca235641dcab7a8c9cb2295d91e94fafaef367b5adf12d94b5279f552cb9fa5cf49c9f8eaa381e74bb17e291931c56a2e4598a853e2c02f2b7bdc4fff36ca6ddf096478566d3711b3915aa931628225c0419f2155d7db62b6dd9036fc4582ad7007000000000000000130100008100000088329424ea10ea1eb3fe5eb1cf42752082f42ec44684c146d78d0a95564559e22b7c3f8eeef4cea4101a378daeadea84ef86550330e03faf829491bf3ad1969ecff2db9be1a4cd7b7cc0bbe342e4b40761874da212fdda420d9c01c08f7a8500d0000000000000000100000000800000d6e67c4a927241e4e58a16e325de9a910fe50ede9ba7f8614facf52627516770121b9b5764eb6afc5f9f63419d3b8f05d85777bc30c5ca702aa801f71b574a90faefb7d5a1f1cb823642f40653befaa7082927aceaba52da3b3ba9d0e206296e45dd71dee1fd35d763c8d385ade84958800482d723311ad0353b1712f37807df693e94de828020d1d792ff18ebd629e12218990424ab487bfb9a3cbf290b687ed0b598532d34fe4ce6f8cd51f1e14b4856ec772a19540c87a987b0dec7720a07"], 0x2b0}}], 0x4, 0x4004000) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) [ 857.865228] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 857.910186] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 857.941870] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 22:01:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 857.984282] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 858.015897] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 22:01:58 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x8c9c0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@private, @in=@multicast1}}, {{@in=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000140)=0xe8) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="060000004c736b4e5f5b22777d113f486402b8ebcf656955d1fde583e7dcb366b119d7d5000000004f2dbbeb3176b7edcb0aee3b5da85893872768399a7bd1725af530cdecbcd7cdb5f4068d4f6080aa2a6cbb83ec3dfd02696b62192787b7950e7adca47e13a97babe60b1e9c", @ANYRES16=r8, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r7, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000180)={@initdev}, &(0x7f0000000240)=0x14) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 858.047644] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 [ 858.102360] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13437 comm=syz-executor.0 22:01:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:01:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:01:58 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x40}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:01:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:01:58 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 858.465516] binder: 13475:13477 unknown command 25348 [ 858.470931] binder: 13475:13477 ioctl c0306201 20000200 returned -22 22:01:58 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000240)={0xfffffffc, 0x1, "fb85c1c2de77da09579a31ba667935e391b0eab971b33d06", {0x7ff, 0xaf}, 0x5}) r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r7, 0x540a, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0205647, &(0x7f00000000c0)={0x1050000, 0x4, 0x5, r7, 0x0, &(0x7f0000000080)={0x0, 0xfffffffb}}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000140)={0x0, 0x6, 0x800, &(0x7f0000000100)=0xffffffffffffffe0}) r9 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) [ 858.549070] binder: 13475:13487 ioctl c0306201 20000280 returned -14 [ 859.835599] Bluetooth: hci0: command 0x1003 tx timeout [ 859.841767] Bluetooth: hci0: sending frame failed (-49) [ 861.915522] Bluetooth: hci0: command 0x1001 tx timeout [ 861.920902] Bluetooth: hci0: sending frame failed (-49) [ 863.995392] Bluetooth: hci0: command 0x1009 tx timeout 22:02:08 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:02:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:08 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000080)=@req={0xff, 0x1, 0x9, 0x7}, 0x10) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:08 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 868.473039] binder: 13513:13520 unknown command 25348 [ 868.490645] Bluetooth: hci0: Frame reassembly failed (-84) [ 868.499310] binder: 13513:13520 ioctl c0306201 20000200 returned -22 22:02:08 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r0, r0, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r1, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r6 = socket$inet6(0xa, 0x3, 0x80000000000004) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) [ 868.532428] binder: 13513:13527 ioctl c0306201 20000280 returned -14 [ 868.533161] selinux_nlmsg_perm: 86 callbacks suppressed [ 868.533174] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 22:02:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 868.618072] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.633122] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.728506] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.752245] binder: 13539:13542 unknown command 287492 [ 868.764529] binder: 13539:13542 ioctl c0306201 20000200 returned -22 22:02:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 868.774424] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.790049] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.849121] binder: 13539:13546 ioctl c0306201 20000280 returned -14 [ 868.870867] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 22:02:08 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r0, r0, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x10801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, @perf_bp={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r1, 0xbfffffffffffffff, 0xffffffffffffffff, 0x9) r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0x0, 0x2}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x4, 0x10400) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 22:02:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 868.946924] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 868.985379] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 [ 869.027743] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13528 comm=syz-executor.0 22:02:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:09 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x822, 0xffffffff7fffffff, 0x0, 0x0, 0x5}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x2) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) r6 = socket$kcm(0x10, 0x3, 0x0) r7 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r6, 0x406, r7) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000e09b000104000000000000000000630000", @ANYRES32=0x0, @ANYBLOB="0356000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r10, @ANYBLOB], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vcan0\x00', r10}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 870.555072] Bluetooth: hci0: command 0x1003 tx timeout [ 870.561543] Bluetooth: hci0: sending frame failed (-49) [ 872.635040] Bluetooth: hci0: command 0x1001 tx timeout [ 872.640539] Bluetooth: hci0: sending frame failed (-49) [ 874.714904] Bluetooth: hci0: command 0x1009 tx timeout 22:02:18 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:18 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:18 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$IMDELTIMER(r2, 0x80044941, &(0x7f0000000080)=0x2) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 22:02:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000d30487fbdb883b510a618b1bc96460d012077213d8f2b28dc05bbccb79d46d9b6ca14671732ff9ba5132e97d3ca7bee01c5635ce2883911ee75884c907ba2f80443db8bc063071792e59fc36c43729e78e335ad6868a762a1c29e487ccd05a311b4af6402474e394c9c6adf84dc9765b7ab869758aef6e1759d8ee34447448ae61ddeb49539defe0cd832accc7b0c395559a17ec87ae13da94474470"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0xe, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000140)={0xc, 0x8, 0xfa00, {0x0}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000080)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r4, 0x1}}, 0x18) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x68, r7, 0x8b8e0eb13081c495, 0x0, 0x0, {{}, {0x0, 0x4107}, {0x4c, 0x18, {0x0, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, r7, 0x400, 0x70bd26, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x7, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x48000}, 0x20000004) [ 878.721942] binder: 13581:13586 unknown command 287492 [ 878.735192] binder: 13581:13586 ioctl c0306201 20000200 returned -22 22:02:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 878.775504] selinux_nlmsg_perm: 39 callbacks suppressed [ 878.775519] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 22:02:18 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000080)={0x2, 0x0, [0x0, 0x0]}) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) [ 878.821076] binder: 13581:13597 ioctl c0306201 20000280 returned -14 [ 878.846184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 [ 878.859682] Bluetooth: hci0: Frame reassembly failed (-84) 22:02:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 878.909458] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 22:02:18 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r3, r3, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r4, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000080)={0x6, 0xffff7735, {r4}, {0xee00}, 0x3ff, 0x7ff}) r6 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf76, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xdc72}, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x11, r6, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r6) r7 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r7) r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x4) [ 878.976056] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 [ 879.035946] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 22:02:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 879.078944] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 [ 879.120884] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 [ 879.162854] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 22:02:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 879.219832] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 [ 879.240938] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13591 comm=syz-executor.0 22:02:19 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:02:19 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340), 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:19 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 879.604403] binder: 13634:13637 unknown command 287492 [ 879.621948] binder: 13634:13637 ioctl c0306201 20000200 returned -22 [ 879.691066] binder: 13634:13644 ioctl c0306201 20000280 returned -14 [ 880.874419] Bluetooth: hci0: command 0x1003 tx timeout [ 880.879852] Bluetooth: hci0: sending frame failed (-49) [ 882.954433] Bluetooth: hci0: command 0x1001 tx timeout [ 882.959895] Bluetooth: hci0: sending frame failed (-49) [ 885.034280] Bluetooth: hci0: command 0x1009 tx timeout 22:02:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETXW(r4, 0x5435, &(0x7f0000000000)={0x4, 0xaf, [0xb3af, 0x1, 0x1, 0x3ff, 0x5], 0x7ff}) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f00000024c0)=ANY=[@ANYBLOB="00feffffffffffff0400000000000000020000000008000004000000000000003f0000000000000005000000000000000000008000000000000000000000000000000000000000008432000000000000000000000000000000010000000000007f0000000000000006000000000000000000000000000000000000000000000002000000000000000000000000000000ffffffff00000000020000000000000005000000000000000000000000000000000000000000000002000000000000000000000000000000faffffffffffffff000100000000000008000000000000000000000000000000000000000000000000200000000000000000000000000000a3388e82db897f7823b5665cf254a64522b9ee74dfc361bcc55e70c7cc4c0415c7f62956fe271a112a6c83b4f5ae53102f7809"]) vmsplice(r1, &(0x7f0000002400)=[{&(0x7f0000000200)="a52a4df97b1864487e1e5af49380bb46f9f97c8eabe7f23c3eb626e77966c6ace3e6d32af917adf9918f2bf661140bfca7bb2bc5abc55bc8d8310189d842cda38e8c1b59f7c675976616b6e7ee9cfeb71156811cb0952caf0dfda47a3f42072e1593922e4fbd8e69524356d22b5d80aebdfb8ac764ef70c2542e917fdc8ff59e5aa7314a0a346780db150172093651f5b62b5c9ddb98fb1c86d6965ad9c3b933324807d47f1547ed7f099b1d6c25f48f50e84c", 0xb3}, {&(0x7f00000002c0)="0a99c6309c4e40d5568e6c47b9e202ab6c2ccd77", 0x14}, {&(0x7f0000000300)="44ce446a11c9e009d570f0821c4055a3b8864b95d8b3c7e7e77ce7f5a7f1e521123edc9b1d769b66a37d62fdf93cc33369d79bd899f3cdd06624499c26bb624bf7724e7f162825f30023064e05a89222df701a31efc785356994fe30d3f3b344dcc9f9697a0b3ac8a6d0f56df6bb7c75632b7d714443df543997feae9f3f960477bb53cdc5fbd01b22aaadf3985dbbf3196625c8406e0cceede30c5d4b725736fc731a949b394395132916f35d35f44e4b70b1a8262929bb8af5fe20a8bb25df56d92ba2923859a78ffb7f1bbc50975b8c4bfee60504b55475a2de8f9f89338f21d97c5675e9c09debc58fe07fa3a1", 0xef}, {&(0x7f0000000400)="a074e645e5f1335b9ec89cb9a91afb12a3390d34e4959be328345683d0bd4d8032ef2015cd9aa905bd5d92c89abc9327649ad87f31cc7b421a5d65c73fd1ac5205a79a576f166715a030b68bc92c73205284ae7a939dade7ad0842aed2a5778566d142f12020b48607a96521e185ef67e6ab51f65cfd2b75ce535846b0c6373f9f15d55c0a9e4a4652e3c8abd80720dfb66a1f80d0a90dc5245e0db9dce7ae2a607d1bbe76e9806a29cc4e8df13baf60601f45cf1af3c12a21c28433ebbefda8560068c6325a420cbba51f5397095a48176cd3ebd5ef1652ce2f22319367acf967b8beec30201d266295d1a43f345a445c556722b54b8125afdb331ac9759750ee10e8a4387e2b5417d23751cefee5cb619bfeadaad562f5b0cd591c95390f9a6d4a6a573e19fd1bbf3e35c98d060f42375e4cbef16596c58b94f3eda25d75c659ada2acfe461368c124f8823465c63ca3eef3b4cf842000dbd1cc05cc9e83018d9a3d907c3e09dab4252c689e1674bcef779a22fbf690a50923e9bbc4990b3bfcbf5f18dd4379126a76453d67c30413dabd8b70c2ad1bac434c1f8cdf41debcb8505eed5136ce56624a1a7004d359fda976a540b2770d87b92f74e1afd1acc9924fe6cb058387bf5bf4b63777c888f711d10ba28ed92b387ab1609bc9fa34d7b95bb0b3400e8615016d6fb8350b22ffc72cb38e0853caca1afaf38c98599b7f0d9dc373f0a22e8d82fb4e8b51c5e8b1e48a4a2c3a4ca7424774082ca01a6f977387c4286834cb601658887ffceb123a3d0083c4ffce147c377b8ecd241a520d293d620113660774542b1e267dc337f21dcf966349ea0ba24940c799e8510866b08934d9a602e0bfc9788a761fc8b1273a9ace21251721320e0ba8fc26eb97a7ab108c68bda4fb4e039ceb847757c070d5d43e90e45985946fcf3d850f14150abb7414fb8729c2bcddfad7e9b95262314066caf18bff1e7b5ea4f9ec167b58bfcfeb68c66067fe14301e5056669e389275e34543c830f85613b33b66fdaf07270ce62e1541d81f7d1c435c39a3eadaeb41d9dc805d4dd4ab730f264b9fe435837de2eb2a7889bdf3966888e5c847b9fb9e526dde67b2cc4f4f072e39494e6e3fb14d507c877d5962e767c89f35fa63870347739a177f869990388a1ce6a8e57af2fbecb3e41cf47612081fce017e5eae62915f184c948bb7508845e79c141326030574cfe1753e227581929698ce1c6902ae36deaf08f7918c229520af2e621e72a5f10c3b2333e07044d53603352ece05f7cf7ecd536987e2f68a8ee2ed1e1a1e78813dd6f8c147b8675272ead650b9f9ae29e480a72a9e8eaaffa3883c54efcb7ef6472f94d9d3a08a0d97038a374837690d63bdf10d07371ad914f072d93452d4fb2387424263cc58f0a22a02c3e2e49857f0c35d8562c93bd03c7b82a7923ba0c72db72ba436f58d802a1ff9e2defa23229ea1851076220b4937b674114b4a851d7262ef712844063ea601d1468010bdf0df56b2b5d3134802919a69d11ce2b3fbb3a99d948806fff1c02709a8aca7a68af406afe70e710695b7279cfe6b4c260450ba7a220eb29e1396ad84c6f8b14d32ae1c89b786977dad32b0076590f1c6d79e137a690ee915a1910cc2699f1ef569f0db4f9f6a5bff11f9505542570c68f9e3e4d5c7beb2001c08521ae03beab5dbcb28e29b0a8780013ac3f23c00422e88d0e66167f31619201e6b39648f899aa01c5f51c7e8de498733839b32e359c4d1cb08b93f10a4239e516cb0e3af099164e07c0dd6b2320ade00b73f0c7e57f994de1a8519635da125898fddb3e8f80692522dd5a703daef7a96a577b9b1ca62e983069f9a40957262b0d6ee07862f90c8e6a35b4585db7f6c3c5509f852663ed331b7752fd1177082a67c745413f6bf3458017d4807972d4b91a55c8d268f92d0027dc4a27e77f9eb5effe1979dbeb9046c0287ca7115e0d85ce51bc3774601c9b92b75eb9fed601de22c148e69d76461ee1e9a14f94774318839f23c5c9a0ba94d0ccfc5b2737bcd1378ae04a5e86b804578708c1746f8e8b81c6640e3415e84bd406605118c19169a08df5c3eaf780d37d8def2f316ac39d04dce58d6347ba7db3f9231372db37f8a68b16a38da29429f1e724021072fb2813f8acb01288acf3ad93e548f1a847cc8d607f8062d80dd14864524a80d5c45aec6e3cc7f66ef4dc2e606a8478de7877d21ddc0f01bd8c6a77414a7d25a6f875223b023595a2ab34f28e6be12decc22963f19ebddebbe2f968f3dd8f90de7acfd28230690b3bdedeb84a6b43e9517576a8a873b8749b13171888e3bc58ac031a2d2112ce222dc2c665b74af0f785487da2e2b9bd43437e0206be049ffe7f0f2b74cfd30711cd2180a8cb2221bf938355892e29ee3032400b0fcf4de37b80933f5af761a50cbedbb3bc09a7e3fb65a8e953de25ef130740ca046f8ed9c8f394cc7a16e6f4d05861720b141ecdc09b83d4692b76d77cb9d6b822adffd8d373eadcfe0ab0976a1d30c2774e630f3222337049b1fc6b5b60355f71c7449db0f1cbf40bb13083b34b550c476ed393bc12e7ab1e72a725619070bac13aeee8790151b0a1954c019b4eca3ce60b3244bf6f9c1f30306602ceabf0b305cff98f11cbcccd9d64b9742d77f9d4a1ca8a1359a32713bdbdc0bff9746101ac12ba98f2e0faefde2433806e93334381023ced138ec710791d9975c72ebc2cfc2a1f98a8ee491dce3277e0212076898959bb260706a966e2ba0102731512b1a88d5bab94844c9dab51f082e76d3277e749f725630a46733d64714d80ad05abdc38b0c941f8eb773b1015aa5f3fa2d37163297dafdac1b78db30d747b2667435bac53b33513a417738cf13088274eb7852f09171090552257ee551f2e12119859701fe77eb0adc546adc0208143bc1965d2186d5f526b6c81f1852b8b441ed29a269e14fe7fbffc87f4000a7d1c0e24b3f45e51b3b0fa084bc838c9b43f78cc240a0d52b7ba87a007ece0888b6b9fae46eb08fb3769985a3e1cf51c4c3b594238f4051af92dfe0381fa85b72eee509f6206a723777b58dcfdaa23453deafdaa94cb8f52940c03f94b8b432f286263aebb580b3d857b07bd0f6ce0469c1429ef8d66d94bf481c67be913231c4e51e3dafc13c1450d19fae5462f0a751dfa845b00cb065fc1761463a44032936b43637b532739a84e9a768e59f4dd58fdcd41a99185f327fcaef6367750ca2f41acb7101e8dce0346c8693d359d7b3162d8324e86c31284a7b3cfa019c99351de09d5dd91f1640b4d279a01a36c9ce337c21db088e4abe150e42ed57368f66583ecb619e6a8f45ea072441917fedb8cc453d420d2a3dd21d5ae8df8030c5f92d6e4f1e00a97194f84fb2ac161f4484bf8c0cb01659b88c9fcf35da41b7ea0a867a13790a11c97c12dd0d90c86291fe7579fa921ca50ff1034c92c0a6239bbce840827d3a5d7103ec2201b3429b18e01db1925697eb4e71d095238a521c8d11dce85e8cbaa178a32ef1b958429a9d32c90af538feda6acb425f7f9d91989af6908514e056d3da819ee98869d714dc5f9b217705f9572cfe28697a844b0c1d50e897456daf34cac0a2e9615e8f088633d34645e5f9d6a3962978366048f362052aea54019987df8758eee370d048b0713fee3a5b20642caa604289ed521b916ec22daa58f23a2625bcc12abac9880ed618bfb3011b64a6c39625499c796193f53b4130b594febbafdc22ac0e5e6581b7db4f87d5b502a7e97f022c0616f3224d99fa4da30e38df8d82c585fdf95909a2bfc7673d1c73f318630ddcd510096339d0355c45d2628a2b2c13ec167c2ab036ffe0cc44bedb339d7f949d023111a4a097d6ab76c5487a01e76a1ac76c216e52d4927c811cfaf227350ed2f277eaf60f20ae13ec59684da242f8ed4f7833cceed5405fbe2c0ec904c25e281d218c47cee5c15c62bb7a0a0455d9e54b7a1a1187112a353d441dc98908bf5120f0c23a4a18f283f5a635eaf367c9278ac2399ab4e5d22f040d49eddc9eba351eb4d372e7267526f08d94ffb09407ab6e8d9ff1204b97474371516da6f0ab259230d52b03f0e330b4eaf845da2f1db81cf55014a922be661922c626052b191caeabf79b9e9778ac61f4cb435cbbf9a2473ddfc155c9bad6553159f7f49cc5b3dd3489bf61e18b2806a8acb9dd20884f6e54fdc1307e0d78696f0f34a78615f26d464123dda54ffecdee30702bed3140b3217696632ca387c2cf7dd519d01d445b7e562cf4cde80c8793e5770505429f9b5409e96b891b403091695a50eed4b8947313f0b52f57be9a1b9e12b526c4116bb9396c64807818f44d09ebda9a78643767072bee6f6fb7efdebcc0f87bc21894bb8df403550d2b82d011012d53e766b9235d2f2b39fab285d8e8cb8bc527230d3290320d099d7b2047b99228190e8bf67babf0dab79004f7783c11108f5109b59ab608ff4936c9298b8d8e6e53657e001058563f9377bfffa0014d7ef40e89ecf75c69db8dd2d3cdc62076a39f44e7f463ce4e83827413c890587eb3b6c67f7c65435fd821948c446b4e6f4f036924c8d0e7f2fc71afc30d682bbf11ca332450d3c8f9ff2c2d24b4d09519ef2d193857a744c42f5e7a4696fbaf0b58df551b3db588f8ebbb342528fa86feda13e217afa4b843b9a1e56012921b958763dbeb34be234af095fc9c7c764e3b914ac3c6437c5ed9033b2ceedd3cc80ad344b440d059d65aff80ecf1d3ead0e4f5064eb48f7eb19d15b169f985eb1eb343254037deecef4c056b99b8df93a2ec8ee9ee454499795f18cf6500369a51bee701ff5a05108c320104edce491541c61acfe171fa77d50121f1cc2c705f7680f6377af04139ab0c3b11c37bcd498dddec38292d3ec069438f50b3c26061c5d10aab4ab3749454ef991bcab7841afdfe6f5fdb58af51914650bb5149773cb1289f6dbb861a19e59115bad7c8e5d38e31eb2ae6e1cf476e679177d98e197f13f2d4e9d061753768998ee934cf78eff3a4a71d93324fc774ead976e43bcdd5b3641e6362506cac66e8c2c7194fcf22c7c31b9c56493276e201ef3f94c98aace67a28c28b77e8ba13c106a7c3efbe5b12e1dbf08810bf2786ca27e78c7384b961d5e937a5e90999681d2630f2998aee456fa218ddd5aaf2dda57b5c2933d47da5571352fa59fe7d05dde090e85a4e3f862c58606636c20d3c7aa171bcdcac06d53941dde7752d886bd8562f1c4efc8160a3d4dd9e33149e69d64635c44854b51518a3135c365fcef3774d2dccd3091af3edeb1936412f1f842fa72a1fc22fc02c0d8ec06991f3665a908f87857bd505cb207b05ebbc97737024258c7ad669e6200d25fab3d3d92cb049f4634ba7553af6b69119d0c5c44386ec1c02fdfd60d16ea65a6d9d0f9893274d0b6e0329a61b45036788882b21539e6359718a27b7fbe1d88e4fc0a61cfa70e22e1c64489a20c6d6a842fae21f2c7e421f80ee59eb6d666ac1300bc6c6482072865b0db56e0ab73ce9cb4f548ec2dc22be0c90042ca683ccd27d041294ce3ccd3b77f9a6aa23b836a2d7183ed65c5709190d7fc697164a59700da0379098673cfb8e6290c77deacb3f909277f4de25818abf28a1391b34a4c914147c2003eb6e42dfeea4dcf6a2a3029158a0cfd82e0c47b32d026d5bd8dbefea733c52bc52863394f869d7718646dd6f326308c8677c815bb4f5da4b85c158f6f62cf5427fab36e8084720f7c40d464e27f1934270409aa7", 0x1000}, {&(0x7f0000001400)="1b0b0062dccd455a19332007e7ba81175dcfdd0536c64c6129d977095db87b665843e470220fa34506e5b31d313a70fa452ccc03743190ee8a62015907ab7dc8ad129bbf78a3701a87c60d2c54506748de110e8854635b8d3b32fae96b97da8a226fd6a04b1cbb00f4ab9fe9d85b6026f46a9f6929c7378977cf2b0dcf418453909de1f92d4f00f9e91e5db1dcfd3e21a9f8254af91e605e16628f248702e7492853d403e57a9c115cfc4cb17c59b3907f8ad7bda7eabf6efea967cb6c13c221814eb5f5fdeb571dd5b60f9d2f0d7b42f487303b5621354a8e37f4f7f071a56fadabc824c5e55feb74a1bdab9eaab1773bef5a9ff62a0acb5f19c5e1fa315cfd35106720a28586c086babd6d667b2fc6fd09f719981dfc65df48da4a27aaea42436b5e9e6ec7bab3bcb968ff8ed88d803178bfe95cdfa616b52b0a3f9808a4571b5352c7b6470abc9fd45664a5ae00b8be64a4b4903e67b3a074e20f2951b038b6846c7c2564fceeb4883e69ec943ef5cf26d65f28763e0f9f5804107400125b08cdf8ef2ad0e331f959fd487118dba419674523f4106e2c782c3ede9f35e8ab8814b95656bfe4a87f88e9eb313c70f101643ca05239085eee7fbb584281855a144c5d54c2b97e8dabcbe4dfc412bde6dab8f08d0d3bc1b475dfcf1d1cf5a4918c4ef83edc8db1ceb2cb3282598038235a78ea59b73dd93e11f52b7dd43fe4ccabdfb86eb4734a0eb6cd5ba5cf9e0d53a0d812f97942555eef9201709b69e98a9ed8f8e18dd570b8b7657c6e4391815bc98a49cdd0d2cf821a383bc4b384b2d906f3d0b5e088d4e8966061f347e0289b1b2899a1eea8db4d2cdf6efe8a51b81bc3bec68082d59881e7c07ccac9ab690d08948aa24271c525c72c919b2168fb9639b396f96eccbb45f45375354be5fb5887d5d06d20babf6d94fab305f3efe089b7b526bec6642af6f28559932e077ec6bd969c0ebab24d1fda797154820bc69260d80488bc0e3afd0a8d6993b3a2a87ac4b4b5861bf942f55dd7d9b42149664e83bcb21edc0e34abd3d390ab1a5a174d8ab298f15c3cecc73041efb98441c960772f7cd0d3534e363a5da7a8d687d06356829d5f5974e249b71d99c7b892c08fa156ce0fe4d1602a15ff30307d17abdd12cf134f02c31ffeefab5c6cdfe9012f0692af0eb330bd4424d8e4d96e65fbeec86093c6dfea5334015c425c24a4dd5eab83493c2674686107e94dd57ab917b524bbd85f9e7f3a77cac10ba474b3eeac796632f96afc2582df302c1f73afe82d0ef89df2d814e37170fe930e3def3c16abda9c86b42b775e42ea5f58b3f3a79eed5b69b6fc2e18cb6ad59482e4de3f354b2a12c172b6a102a718e25ee9c00196b837372dfefa1dd9550e9ede94c6feb047bda3df56ff2b3c4e5a1f4acdfced80b5c9dfa62e4a3bacd711b130e102069f614309efb140e46b501a2c20f6f532cbc5b3cfcf09dbb23db6f5b5ea295ce1e4afb4d75f18d7018d159cfd5eda75789b4892e3dc4ba686d50ae41c4c2622a8382b0a0defdcb491d1c9222eb6ec180d5ba8f1eb664c8d6fce3a4f55b8195331a6ce80cf47392af80a015d0111fa32f77d37be7cc37f7bd358f4095ae83e6344b68d1d9d66340e37f2dd46304f35f60fb737c33403cb3a7f3fbb1af4e0a32688ef20deae7d7badfd7ad2d2f1dbee668b573f457b8a2e8f79a43eb0e9e9aa6b0f6b5db3dcec8b95b0ff8ce7a05e2e4eec48c9d5cd553338dc692e38b403c6e4563b4a4f30a5f9ba3f112dcb44e9c38f1e8686172ac49a156dbf36015f123aad86a435db87a50a58402e3131a4df375fc9c436fd51c3a1fe60bfe4c26eae2cbc8893a3ca3b8bdd43d9bcca1f89698dd1d7a698653af3585bcd5f64ee511ea741c4fc57fab0bfea7f5159a89a9036a73d7032eac4fb6a2cc87bc212b9dbb3f7b678848b24c1beba9ac3aa2ce1f82c3fe9b688296be028bb1c73b0279b25baa4bbc199d305cd6194e0a6e857243ad800e9415686a06ca02a540d279e39b30f393725154ae6d2e733897ea3179ff463459e14514fb3a58e68cee1ffd6142e167fcbc437db8982a1ff97f1808d8c8563a3c221342636137a6bc60d7ac0988b15111cfa66affbcf375258babc995a5827b3af116434e74209badd2cb00fc0da82d9ffa6ca60239edfef1174afaa955a1306e14c73009f9284d42224ab04c6b389be779415ee49bfc47a420007d7c620586e2d5341cadaf73a86fa1d2fcb68fd1d2f8b821e633b4491f284971bba83391e1b94c179c536a0de0a252c296a5acb7139adddd176f3b3adaa1033ccdc3fd9d1a82a823e375af3ca9a6dd77aa0e2cc218821cd663c01cbf800bda9894c25f9ff301c57092cb7e118071bb5b0cd737160faa8216d6094904954bc26d749ccf0a0274692cd06354c1e75a258b8f36d570db67645e2d21efbdfb960d8e35cd82628487749fbf5574c011dd2f0e68ae875c4c7e778ae52c39d4789a3b9eac0f0e7c10b21d33229e3fe9b72d19776d78e3bfc4d3c9e3243e265bdb6b857fe82019bc8e96457e610dbaecd6f68b5b35f937f047f164daa27dc8b1e1a8421b092a425e1d7aac05eeabb9ff2fc57ab2f408ccae73dc5689d90fb80f1f5c60b4afb1052c0ad4e1109368effdfa76043ce1d199673cca139f6554ddcab374a535e5a0f3a03d0037214cfc8b754ab0acf188e4bed058e30be250873e6d00e7429a299294b59f35fc765cb76f52454cd1d0d779e43a141f419ae03dc77cb9859745e4b5daa189e6adb0c315cfebc11d07e3990257fe756a0ca1ef2c8f407b9394d849aeb9997f66dfe6f4eb247b7fb2d10007e8293cae409111d01c3b8e1e1c3bb470bc4c075ae093dff4fbe63c79c97cb5724740021f831361d18fbcb3224f075af15cbf1809a618eeee6e870cd8c97b72d12b0171a94ae9c326f927cad6560e9433fe5f722c6a04a73e13a57f7e528fee2481eb937fdd2106f5abaf3f14ab713448a98b37e974f2a9c85d3043ace21771b0ad5932cbf5318712cd46deff01c0fed64772d9c5518153996e7d1b1cd5bf658250e99f87a6518615e8e8c3196ac12a7deafa45c32e171880000ae6dca2ca3f50b96477be4757e2ba01008e8a8ece9d791b1bc5e36026ddee5a4bb81f1c483dfb916cee4c67c3c52ffe509a9cd459c5b786af72812d8df0278e5938f7490b3ed66660d22b8c3d33b7119ab4775a4b65d257882c3e73b133dd4e2dcc0fd977388bb7c25ba1ecf769e94e007b883c26e1524141428678bff3d53651940d57da9681d6dd8a8f7e044600ce2c8292e657a140638d95f92dda99189bc949a805547732bb4a9bf093f4f9c377e82e09a9e12bfd330e0c558d1043a52595565c3e22dead3c59500ba35816d7fea91bbf3251ff91ca69d7c911739294cdba1dc58a6cf6e81e37cadb3a2c33d162105eb35ef0c89fc4af071a33bc4031cfd80898842dc5333a996e1219b7f028480f1a433d6769f065e57f4caf57fb4b9a0efb048ebba06f0282488ff6ff9c32bc24ff3cc4523deeef3199fe839910b1ab639b5b39c5d2aa7656f8558d0fee7765eb6a2039e334c16b2bf008280289fb1663d001492b22dfb681ac3b700ea171a4bae741971f6bfe56695c424fadca8fa929c198802fbff3aa3fc6bc932a9f106476cd27922024453b604ce15f64f92125499c3563e65f9969903bd69a3fbaa54429e765d3c9d5238ec2957c8473e9e5b9b461e7865f53734d451d8f68eef1d361e8b7a56389143b6c4462f6248236856f0b81d52aa5332aa34c1322a2d49a8bbc989073d42ea0e547805424efd16a4786d18ea1334d254a7b681ee43b4aa1ebd10eecb409c8766ece6272e304c3804d589bbc0c5abf18174998a1748e367ab892790e0cc57d81e7e1ec57aa115a98faafd731d4fc29d48ec87eb9405019aef9aa7e8d062c6433cd94bc2a267ca59fee724cb81cea7933ee35e2ea47600abc9afba4ee6ecfe6944dfb8c750c525dfcfbbd6cd9f399c50afd5b44b5c40604cdb8d033b6a5f245e736931cb0f43a83421d799d7e0632c0f69ab61d8bd92e931c0abbd9b0f680d9c8b71185debf97de0d08d30029b0dd1c458cf5da647273fe5d27e6353cae1e77a1a4c48fcb964f6cc4382505f61f700a0aeb08e6c3d0fa7a9304a1e19e682cdbf5a6b83945310d4bed36550630a5c84b616c3fe380f819d9a4d23fa4eb38926f4a584877bd9c048eefd771376b1ad6e875a2c81e7e264b2b9b7ef6644aee6e5a40e2712151b2e810cb4872b04e8869bc65a02facc781c6452bfb1b0e9a80c5b4b9a92ddf88ed0c904b7ec1b3071133e1977e6702de43ee6ccde7fd9c8ff574546999c3a53f899f5b5656a9f6a97d1a7045a6c0341c7c0bee90b910bc999e55c7a3fa3ef543495d16c6792c7b9ef06bc4f05d9d9b724df4290ab808d3bda7e9779261b6b625b3dbb88e227e9beb0a11a3b98f48cdb15ebe394fb1c3ba51b0c0490aabf6421cb4103e8e0651b7ddbcddce6b5bd49b3c6eb0de7d28bee23d983f944f465b55d82335f39bb84e4e27025e8c656f46e41fef60b7f131603c6c146f9d7ee02ec560156c03cf5e86919c6197e5e2879d6607267af65241b028dccea3fb13d1f72b04a2b881a10a7a78497593a184e43e8444048782ac87d1032412a71aa1bd2073d1a753209ca2dc99afddddeaff25013cb3c427ae7c2c7dbe6710d9aa5055e0e9f5d3076eba2673a9a8eaa48c6bb3227529bdb01a13e8dfa7f36efaac68379317ee2dc6a4e93090528185b82a567c78e8459352fc1070f7b981bb64af929519c7c1fef384078d04b0f098211d65c844a0fd85be984389d75d0aaae0a5f1a50bcdca13bcbb350d1e9dadfb85db4665f0ac0622b8edf76e4a185dc002b5050e68958f76e202fbf6b62ce86069262f0553e72ef6b6420e57920f34a7ec274386e51593b7bd7dc0c44189fd4920a52a64ca9347d403c93ba583c34faad9499aa70768fc46834f3e7747b6384cd8bee62cb8cafc0f1d4b8652ec18e0765189583d2d73c5415074b8f18e11a8ec6e0876d190a16bfb80f802cc57b7d2324d184347acbec8c8531775ed53d8c94df94f4d18645f10310e92dda09ace980744e57eecd4842811ce7b5296991e306d2b505c87e45a99a472f29ff44f2ad3573a61c3745bf1d542239e6ad223fecab5acfc1df9a7e80ba05bc16c052994a664ec9ab7397d842a9ce104fefd7070da252b365cb1e91839d6024d7455b9b82c03c339c5756b33e553498f6723e9d908c9850312a2a9eae3839ffcbaf4da73d4d1e7fb97e5bb899b0aaf44747cf37d09565b95a68c44a67451f0fd2f847ea34acd823b5110a6d747681291cf9d6d51801d7944956f4233c7ad250077ed69754e77d117f5317290ee3202b903d4a1132b4ef2c6e89f214d53260941b6193dea261889dcf8a596f0c6c80f4056896de4196a282f9fe0bdb3e543cea559261620a77d391d1134437901c8b2afad5818e4343bb8c9d9ad712898bf947b0323a9bd20e787cd0d7d0bb5f1fcd50f956c9dfef8b1423996d4b11fc60ce0afcae8809b1fa45ffd51fee39dcb030f15e7efaec28f5af1584de9aea731eaa704fdcea573efc4c1836defd9c746007aeb7e04a84b3de42e19b63e5da0c7485f59f05eed6b846d7927982c6a6bd9d717a779bfb5cb0bf5ff4dc3ec86a90f59a2f2ce4bd9fe27fa0c4d3aa24a1eca211d260a4e222c9ed098c89141ccbcfa005619f009a5cb2182c28e430e04c1bab9a020f72e0a41e5a7ae002d5928a18794740100a", 0x1000}], 0x5, 0xe) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xd) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000100)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r5 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSETD(r5, 0x5412, &(0x7f0000002480)=0xd) r6 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x6, 0x200080) ioctl$DRM_IOCTL_MODE_ADDFB(r6, 0xc01c64ae, &(0x7f0000000180)={0xfffffffd, 0x6bf, 0xff, 0x5, 0x5, 0x1000, 0x5}) 22:02:28 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340), 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:02:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x444002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x20) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:02:28 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 888.974233] binder: 13663:13670 ioctl c0306201 20000280 returned -14 22:02:28 executing program 5: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:02:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 889.022117] selinux_nlmsg_perm: 86 callbacks suppressed [ 889.022133] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 22:02:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 889.093524] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 22:02:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 889.153855] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.162317] binder: 13679:13683 ioctl c0306201 20000280 returned -14 22:02:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 889.227394] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.261492] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 22:02:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x300000, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r2, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpgid(r2) get_robust_list(r3, &(0x7f0000000140)=&(0x7f0000000100)={&(0x7f0000000080)}, &(0x7f0000000180)=0x18) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r4, 0x540a, 0x2) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 889.316955] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.323857] binder: 13691:13693 ioctl c0306201 20000280 returned -14 [ 889.376284] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.441525] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.486585] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 [ 889.563254] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13674 comm=syz-executor.0 22:02:29 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340), 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:29 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:29 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) [ 889.814056] binder: 13706:13707 ioctl c0306201 20000280 returned -14 22:02:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 889.963832] binder: 13714:13715 ioctl c0306201 20000280 returned -14 22:02:29 executing program 5: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 890.113136] binder: 13720:13722 ioctl c0306201 20000280 returned -14 22:02:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 890.246802] binder: 13727:13728 ioctl c0306201 20000280 returned -14 [ 891.193974] Bluetooth: hci0: command 0x1003 tx timeout [ 891.200454] Bluetooth: hci0: sending frame failed (-49) [ 893.273901] Bluetooth: hci0: command 0x1001 tx timeout [ 893.279370] Bluetooth: hci0: sending frame failed (-49) [ 895.353781] Bluetooth: hci0: command 0x1009 tx timeout 22:02:39 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x3, 0x6, 0x805, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}, 0x1, 0x32a8}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x1, 0x0) sendmsg$AUDIT_SET_FEATURE(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x3fa, 0x20, 0x70bd25, 0x25dfdbfb, {0x1, 0x1, 0x1}, ["", "", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000010}, 0x44800) ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000000)=0x2) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000100)={0x2, 0x9, 0x3}) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000280)={0x9, 0x3, 0x0, 0xde, 0x4, "af733245d7571c7d"}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$SIOCAX25ADDFWD(r3, 0x89ea, &(0x7f00000002c0)={@bcast, @null}) 22:02:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:39 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:39 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:39 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:39 executing program 5: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x3, 0x5) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) [ 899.815307] binder: 13746:13750 ioctl c0306201 20000280 returned -14 22:02:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 899.881240] Bluetooth: hci0: Frame reassembly failed (-84) [ 899.902370] selinux_nlmsg_perm: 86 callbacks suppressed [ 899.902383] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.012370] binder: 13763:13764 ioctl c0306201 20000280 returned -14 [ 900.016590] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 22:02:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 900.103952] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.188083] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.195078] binder: 13768:13769 ioctl c0306201 0 returned -14 [ 900.246914] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.250899] binder: 13768:13769 ioctl c0306201 20000280 returned -14 22:02:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 900.306623] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.378370] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.410886] binder: 13771:13772 ioctl c0306201 0 returned -14 [ 900.435177] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.450219] binder: 13771:13772 ioctl c0306201 20000280 returned -14 22:02:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 900.508259] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.568150] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13760 comm=syz-executor.0 [ 900.634699] binder: 13776:13777 ioctl c0306201 0 returned -14 [ 900.668254] binder: 13776:13777 ioctl c0306201 20000280 returned -14 22:02:40 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:40 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) [ 901.913327] Bluetooth: hci0: command 0x1003 tx timeout [ 901.918832] Bluetooth: hci0: sending frame failed (-49) [ 903.993256] Bluetooth: hci0: command 0x1001 tx timeout [ 903.998656] Bluetooth: hci0: sending frame failed (-49) [ 906.073157] Bluetooth: hci0: command 0x1009 tx timeout 22:02:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/btrfs-control\x00', 0xc4040, 0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x11, 0x4, 0x201, 0x70bd25, 0x25dfdbfb, {0xa, 0x0, 0x3}, [@generic="4f133cd4135d986af1b475fdb6616f371c380f7fe821e5e8386e32cdb2fd3db33269fd99d304e732dcb0de32dbcc04baa73ba5fa1a5790b3a398356df9c6365166"]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)={0x9, 0x6b23, 0xc6a, 0x200, 0xb, "aa0c2e791390a5c6d1eb0bc930e470c54c48b4"}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000340)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000380)={0xc80, 0x600, 0x1e0, 0x384, 0x10000, 0xffff, 0x8, 0x1, {0x0, 0x2}, {0x8, 0x80000001, 0x1}, {0x75cf, 0xfffffffc}, {0xff, 0x8000, 0x1}, 0x2, 0x80, 0x9, 0x7, 0x0, 0x20, 0x9, 0x80000001, 0x4, 0x6, 0x7fffffff, 0x4, 0x1, 0x100, 0x3, 0x1}) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100)='/dev/input/mice\x00', 0x40000) getsockopt$inet_mreq(r4, 0x0, 0x24, &(0x7f0000000140)={@broadcast, @loopback}, &(0x7f0000000180)=0x8) 22:02:49 executing program 5: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r2) quotactl(0x381, &(0x7f0000000080)='./file0\x00', r2, &(0x7f00000000c0)="baf0c749785b") r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r3) r4 = socket$inet6(0xa, 0x3, 0x80000000000004) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={0xfffffffffffffffe, &(0x7f0000000100)=""/124, 0x0, 0x7c, 0x1}, 0x20) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 22:02:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:02:49 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 910.133083] selinux_nlmsg_perm: 54 callbacks suppressed [ 910.133098] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.166694] binder: 13805:13819 ioctl c0306201 20000280 returned -14 [ 910.242502] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.270465] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.284672] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.302285] binder: 13820:13824 ioctl c0306201 20000280 returned -14 [ 910.309269] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.325994] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.345595] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.359265] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.373352] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 [ 910.385890] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13818 comm=syz-executor.0 22:02:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:02:50 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:02:50 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:02:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)={0x0, 0x4}) ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000080)=0x18) 22:02:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 911.054736] binder: 13825:13833 ioctl c0306201 20000280 returned -14 [ 911.180826] binder: 13838:13845 ioctl c0306201 20000280 returned -14 [ 912.152913] Bluetooth: hci0: command 0x1003 tx timeout [ 912.159290] Bluetooth: hci0: sending frame failed (-49) [ 914.232930] Bluetooth: hci0: command 0x1001 tx timeout [ 914.238311] Bluetooth: hci0: sending frame failed (-49) [ 916.312637] Bluetooth: hci0: command 0x1009 tx timeout 22:03:00 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCGETX(r1, 0x5432, &(0x7f0000000080)) 22:03:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:00 executing program 3: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0xfff}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) fcntl$notify(0xffffffffffffffff, 0x402, 0x2) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r6, r6, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r6, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r7, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r5, &(0x7f0000000100)=r7, 0x12) fchdir(r4) 22:03:00 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 920.384296] Bluetooth: hci0: Frame reassembly failed (-84) [ 920.421012] binder: 13865:13878 ioctl c0306201 20000280 returned -14 [ 920.427421] selinux_nlmsg_perm: 86 callbacks suppressed [ 920.427435] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.452938] binder: 13863:13879 ioctl c0306201 20000280 returned -14 [ 920.484293] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.498470] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.512971] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.525746] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.540704] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.554841] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.569982] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 22:03:00 executing program 3: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0xfff}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) fcntl$notify(0xffffffffffffffff, 0x402, 0x2) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r6, r6, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r6, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r7, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r5, &(0x7f0000000100)=r7, 0x12) fchdir(r4) [ 920.583755] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 [ 920.597480] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13880 comm=syz-executor.0 22:03:00 executing program 3: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7ffffffffffa, 0x693d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x24, 0x0, 0x0, 0x5, 0xfff}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) fcntl$notify(0xffffffffffffffff, 0x402, 0x2) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r6, r6, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r6, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r7, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_pid(r5, &(0x7f0000000100)=r7, 0x12) fchdir(r4) 22:03:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 921.287502] binder: 13899:13934 ioctl c0306201 20000280 returned -14 [ 921.314455] binder: 13898:13943 ioctl c0306201 20000280 returned -14 [ 922.402207] Bluetooth: hci0: command 0x1003 tx timeout [ 922.407664] Bluetooth: hci0: sending frame failed (-49) [ 924.472162] Bluetooth: hci0: command 0x1001 tx timeout [ 924.477542] Bluetooth: hci0: sending frame failed (-49) [ 926.552144] Bluetooth: hci0: command 0x1009 tx timeout 22:03:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000100)=""/106) mlockall(0x3) 22:03:10 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:10 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) fanotify_init(0x0, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(0xffffffffffffffff, 0x1, 0x20, r3, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:03:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:10 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 930.586906] Bluetooth: hci0: Frame reassembly failed (-84) [ 930.605592] binder: 14059:14078 ioctl c0306201 20000280 returned -14 [ 930.605647] selinux_nlmsg_perm: 38 callbacks suppressed [ 930.605661] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 930.647565] binder: 14061:14085 ioctl c0306201 20000280 returned -14 [ 930.768297] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 930.859764] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 930.924368] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 930.981399] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 931.073621] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 931.175214] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 931.232046] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 [ 931.297443] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 22:03:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:11 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:11 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) fanotify_init(0x0, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(0xffffffffffffffff, 0x1, 0x20, r3, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) [ 931.361509] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14079 comm=syz-executor.0 22:03:11 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a", 0x11}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 931.474850] binder: 14208:14225 ioctl c0306201 20000280 returned -14 [ 931.506926] binder: 14213:14228 ioctl c0306201 20000280 returned -14 [ 931.534100] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. 22:03:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 932.376248] binder: 14369:14375 ioctl c0306201 20000280 returned -14 [ 932.631750] Bluetooth: hci0: command 0x1003 tx timeout [ 932.637163] Bluetooth: hci0: sending frame failed (-49) [ 934.711658] Bluetooth: hci0: command 0x1001 tx timeout [ 934.717189] Bluetooth: hci0: sending frame failed (-49) [ 936.791554] Bluetooth: hci0: command 0x1009 tx timeout 22:03:20 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x80, 0x0) getsockopt$packet_int(r3, 0x107, 0x9, &(0x7f0000000200), &(0x7f0000000240)=0x4) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x751af95119fbe6c1, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="001b000077fbb54bd1ddeac355175cdcdb32f416a49206ca29eb7dcdba22369559e8b35c2b9ae0385cb40ba041f822b7e70e983aa766bea1edd4ba8e21138880a358a218c3f5f595b188453bdbd410e32a39628f0cc76a02e1b81b729da95e6fc48e3bda31ceaada82f288dd24786e2ec4d08033047e972042aa153a5a5ebbf424051333", @ANYRES16=r2, @ANYBLOB="08002bbd7000fbdbdf251d0000000897787f3bff92a2722500010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r1, 0x4018ae51, &(0x7f0000000080)={0x6, 0xfffffffffffffffc, 0x800000000000000}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:03:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:20 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a", 0x11}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:20 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) fanotify_init(0x0, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(0xffffffffffffffff, 0x1, 0x20, r3, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) [ 940.838499] binder: 14386:14391 ioctl c0306201 20000280 returned -14 [ 940.877750] Bluetooth: hci0: Frame reassembly failed (-84) 22:03:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 940.883836] Bluetooth: hci0: Frame reassembly failed (-84) [ 940.900248] binder: 14385:14400 ioctl c0306201 20000280 returned -14 [ 940.923827] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. [ 940.967150] selinux_nlmsg_perm: 53 callbacks suppressed [ 940.967164] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.004926] binder: 14404:14408 ioctl c0306201 20000280 returned -14 22:03:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$int_out(r2, 0x5460, &(0x7f0000000040)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 941.020912] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.050797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 22:03:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 941.109075] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.134530] binder: 14410:14413 ioctl c0306201 20000280 returned -14 [ 941.140483] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 22:03:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 941.194004] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.258440] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.283476] binder: 14418:14430 ioctl c0306201 20000280 returned -14 [ 941.334876] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.409567] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 941.498007] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14401 comm=syz-executor.0 [ 942.951191] Bluetooth: hci0: command 0x1003 tx timeout [ 942.956609] Bluetooth: hci0: sending frame failed (-49) [ 945.031056] Bluetooth: hci0: command 0x1001 tx timeout [ 945.036477] Bluetooth: hci0: sending frame failed (-49) [ 947.111046] Bluetooth: hci0: command 0x1009 tx timeout 22:03:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:30 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a", 0x11}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:30 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x0, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:30 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000240)=0x16) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x3, 0x208200) socket$xdp(0x2c, 0x3, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000180)={0x4, 0x2, 0x5, r2, 0x0, &(0x7f0000000140)={0x99096d, 0xffff, [], @ptr=0x9}}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) getsockname$packet(r3, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000000)=0x14) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000037a07c746a03b2ddb267411e7a0ce150cd5bbface63ae1422ea799fa9213bd7978f000000000000000000000000000000000000000000000089bb1788eac238979913e67b74cd9a9f712b9fa12dfd78dfdcae4b84910192dae7b645043b8c1ab7d5c2ca1ffacbfe2bc625828ef1f89379c95d005dc6f41fd2c41fb2a83b6b76bd404f10b8f500b38b11212f756efd7b7f7fb55a0950726890d4c6e976382b42a088b6ffcac34a8063488f62848b8583a90252c701f8a4efac3c2289f601bafc6ed9cd882426e5f4232bdcc6c689b2328fb00a5b81c652a4857d32f97c81121b2ae1593f0a799939e765a03d646f913d50e37825ed7898fae6c6368c8a03c2a7", @ANYRES16=r6, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_GET_FPU(r5, 0x81a0ae8c, &(0x7f0000000280)) [ 951.054487] binder: 14574:14582 ioctl c0306201 20000280 returned -14 [ 951.089315] Bluetooth: hci0: Frame reassembly failed (-84) [ 951.099643] Bluetooth: hci0: Frame reassembly failed (-84) [ 951.105412] binder: 14573:14600 ioctl c0306201 20000280 returned -14 [ 951.117218] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. 22:03:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 951.176510] selinux_nlmsg_perm: 37 callbacks suppressed [ 951.176525] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.253863] binder: 14622:14636 ioctl c0306201 20000280 returned -14 [ 951.285318] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 22:03:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 951.364052] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.431191] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.482908] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.542870] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.572421] binder: 14678:14712 ioctl c0306201 20000280 returned -14 [ 951.644492] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 22:03:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 951.727869] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.781284] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 [ 951.818392] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14601 comm=syz-executor.0 22:03:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:31 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x0, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 951.879510] binder: 14738:14764 ioctl c0306201 20000280 returned -14 22:03:31 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891", 0x19}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 952.005391] binder: 14771:14817 ioctl c0306201 20000280 returned -14 [ 952.077261] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. 22:03:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 952.117604] IPv6: NLM_F_REPLACE set, but no existing node found! [ 952.126944] binder: 14805:14837 ioctl c0306201 20000280 returned -14 22:03:32 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 952.296501] binder: 14867:14887 ioctl c0306201 20000280 returned -14 22:03:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 952.537785] binder: 14904:14956 ioctl c0306201 20000280 returned -14 [ 953.112403] Bluetooth: hci0: command 0x1003 tx timeout [ 953.117803] Bluetooth: hci0: sending frame failed (-49) [ 955.190592] Bluetooth: hci0: command 0x1001 tx timeout [ 955.195978] Bluetooth: hci0: sending frame failed (-49) [ 957.270458] Bluetooth: hci0: command 0x1009 tx timeout 22:03:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:41 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891", 0x19}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:41 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x0, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000140)={r6, @loopback, @multicast2}, 0xc) ioctl$VFIO_IOMMU_UNMAP_DMA(0xffffffffffffffff, 0x3b72, &(0x7f0000000100)={0x18, 0x1, 0x9, 0x1}) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000080)={0x1, 0x3, 0x0, 0x80000001, 0x3}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 961.297754] binder: 15060:15094 ioctl c0306201 20000280 returned -14 [ 961.305791] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. [ 961.335923] Bluetooth: hci0: Frame reassembly failed (-84) [ 961.346460] IPv6: NLM_F_REPLACE set, but no existing node found! [ 961.384825] selinux_nlmsg_perm: 52 callbacks suppressed [ 961.384841] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.415955] binder: 15059:15139 ioctl c0306201 20000280 returned -14 22:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 961.492982] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.565625] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.625742] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.636525] binder: 15175:15187 ioctl c0306201 20000280 returned -14 22:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 961.744990] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 22:03:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 961.796516] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.826510] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.865391] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 [ 961.881802] binder: 15222:15228 ioctl c0306201 20000280 returned -14 22:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 961.954189] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 22:03:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 962.038332] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15097 comm=syz-executor.0 22:03:42 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x0, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:42 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891", 0x19}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 962.125405] binder: 15269:15303 ioctl c0306201 20000280 returned -14 [ 962.142858] binder: 15289:15316 ioctl c0306201 20000280 returned -14 22:03:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 962.253132] netlink: 57 bytes leftover after parsing attributes in process `syz-executor.0'. [ 962.268546] binder: 15328:15352 ioctl c0306201 20000280 returned -14 [ 962.282994] IPv6: NLM_F_REPLACE set, but no existing node found! 22:03:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:42 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 962.454902] binder: 15374:15384 ioctl c0306201 20000280 returned -14 22:03:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 962.637926] binder: 15419:15458 ioctl c0306201 20000280 returned -14 [ 963.350250] Bluetooth: hci0: command 0x1003 tx timeout [ 963.355667] Bluetooth: hci0: sending frame failed (-49) [ 965.430161] Bluetooth: hci0: command 0x1001 tx timeout [ 965.435605] Bluetooth: hci0: sending frame failed (-49) [ 967.509977] Bluetooth: hci0: command 0x1009 tx timeout 22:03:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:51 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039", 0x1d}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:03:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, 0x1407, 0x200, 0x70bd27, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4804}, 0x4000080) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:03:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x0, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 971.545913] Bluetooth: hci0: Frame reassembly failed (-84) [ 971.550030] binder: 15538:15562 ioctl c0306201 20000280 returned -14 [ 971.562611] binder: 15536:15563 ioctl c0306201 20000280 returned -14 [ 971.573278] IPv6: NLM_F_REPLACE set, but no existing node found! 22:03:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 971.627232] selinux_nlmsg_perm: 52 callbacks suppressed [ 971.627248] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 971.757126] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 971.793422] binder: 15597:15627 ioctl c0306201 20000280 returned -14 22:03:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 971.902583] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 971.943947] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 972.016769] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 972.031571] binder: 15656:15680 ioctl c0306201 20000280 returned -14 22:03:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 972.064738] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 22:03:52 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) [ 972.109794] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 972.139101] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 [ 972.180173] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 22:03:52 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) [ 972.220628] binder_alloc: 15701: binder_alloc_buf, no vma [ 972.226249] binder: 15701:15707 ioctl c0306201 20000280 returned -14 [ 972.234900] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15566 comm=syz-executor.0 22:03:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:03:52 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039", 0x1d}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:03:52 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) 22:03:52 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x0, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:03:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 972.438656] binder: 15716:15723 ioctl c0306201 20000280 returned -14 [ 972.447968] IPv6: NLM_F_REPLACE set, but no existing node found! [ 973.589567] Bluetooth: hci0: command 0x1003 tx timeout [ 973.594987] Bluetooth: hci0: sending frame failed (-49) [ 975.669509] Bluetooth: hci0: command 0x1001 tx timeout [ 975.674951] Bluetooth: hci0: sending frame failed (-49) [ 977.749405] Bluetooth: hci0: command 0x1009 tx timeout 22:04:01 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:04:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:01 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039", 0x1d}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 981.746288] binder: 15757:15763 ioctl c0306201 20000280 returned -14 22:04:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 981.788279] Bluetooth: hci0: Frame reassembly failed (-84) [ 981.802624] IPv6: NLM_F_REPLACE set, but no existing node found! 22:04:01 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 981.835113] selinux_nlmsg_perm: 84 callbacks suppressed [ 981.835129] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 981.854138] binder_alloc: 15758: binder_alloc_buf, no vma [ 981.883859] binder: 15758:15772 ioctl c0306201 20000280 returned -14 22:04:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:01 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 981.934915] binder: 15775:15777 ioctl c0306201 20000280 returned -14 [ 981.935230] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 981.967423] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 22:04:02 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 982.043258] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.050824] binder: 15781:15782 ioctl c0306201 20000280 returned -14 22:04:02 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 982.103047] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.170337] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.213788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.243540] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.274806] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 982.287366] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15771 comm=syz-executor.0 [ 983.838966] Bluetooth: hci0: command 0x1003 tx timeout [ 983.844396] Bluetooth: hci0: sending frame failed (-49) [ 985.908687] Bluetooth: hci0: command 0x1001 tx timeout [ 985.915187] Bluetooth: hci0: sending frame failed (-49) [ 987.988536] Bluetooth: hci0: command 0x1009 tx timeout 22:04:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x480002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:11 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:11 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:04:11 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891000000390008", 0x1f}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:04:11 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:11 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 992.028204] IPv6: NLM_F_REPLACE set, but no existing node found! 22:04:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x349542, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x5) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:12 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 992.078534] binder_alloc: 15805: binder_alloc_buf, no vma [ 992.084525] selinux_nlmsg_perm: 37 callbacks suppressed [ 992.084541] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.133320] binder: 15805:15818 ioctl c0306201 20000280 returned -14 22:04:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x15) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDADDIO(r2, 0x400455c8, 0x3) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x101000, 0x0) [ 992.183180] binder: 15824:15828 ioctl c0306201 20000280 returned -14 [ 992.200371] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 22:04:12 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 992.261494] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 22:04:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 992.302472] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 22:04:12 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 992.383226] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.471854] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.527225] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.584371] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.616211] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 [ 992.674944] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15817 comm=syz-executor.0 22:04:12 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:12 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r6, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r6, r6, &(0x7f0000000240), 0x7fff) 22:04:12 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891000000390008", 0x1f}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:04:12 executing program 5: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 992.968353] IPv6: NLM_F_REPLACE set, but no existing node found! [ 992.975714] binder: 16004:16048 ioctl c0306201 20000280 returned -14 22:04:12 executing program 5: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:13 executing program 1: keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default trusted:e'], 0x1, 0xfffffffffffffffd) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) fcntl$dupfd(r0, 0x0, r1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x400000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x7) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0x1f1, 0xfffffffffffffffe) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x0) ioctl$TIOCSETD(r3, 0x5412, &(0x7f0000000000)=0x2) 22:04:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:04:13 executing program 5: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 993.380959] encrypted_key: keylen parameter is missing 22:04:13 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) [ 993.406669] Bluetooth: hci0: Frame reassembly failed (-90) [ 993.494829] binder: 16145:16146 ioctl c0306201 20000280 returned -14 22:04:13 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 993.731270] binder: 16167:16191 ioctl c0306201 20000280 returned -14 22:04:13 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(0x0, 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:13 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa8430891000000390008", 0x1f}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:04:13 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 993.858251] binder: 16205:16231 ioctl c0306201 20000280 returned -14 22:04:13 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(0x0, 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 993.922953] IPv6: NLM_F_REPLACE set, but no existing node found! [ 993.956368] binder: 16233:16236 ioctl c0306201 20000280 returned -14 22:04:13 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 994.142415] binder: 16288:16297 ioctl c0306201 20000280 returned -14 [ 995.437212] Bluetooth: hci0: command 0x1003 tx timeout [ 995.442655] Bluetooth: hci0: sending frame failed (-49) [ 997.507031] Bluetooth: hci0: command 0x1001 tx timeout [ 997.512462] Bluetooth: hci0: sending frame failed (-49) [ 999.586970] Bluetooth: hci0: command 0x1009 tx timeout 22:04:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) 22:04:23 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(0x0, 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:23 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x5) r1 = socket$kcm(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x0, 0x0) fcntl$dupfd(r1, 0x406, r2) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000080)={'ip6gre0\x00', 0x3}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCSRS485(r3, 0x542f, &(0x7f0000000100)={0x7, 0x3ff, 0x4}) 22:04:23 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039000800", 0x20}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 1003.521419] mkiss: ax0: crc mode is auto. 22:04:23 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1003.562144] binder: 16344:16364 ioctl c0306201 20000280 returned -14 [ 1003.564050] binder: 16347:16369 ioctl c0306201 20000280 returned -14 [ 1003.585868] IPv6: NLM_F_REPLACE set, but no existing node found! 22:04:23 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1003.654149] selinux_nlmsg_perm: 131 callbacks suppressed [ 1003.654165] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 [ 1003.675780] mkiss: ax0: crc mode is auto. [ 1003.728585] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 22:04:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x4c4f00, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x6) ioctl$TCXONC(r0, 0x540a, 0x3) [ 1003.775676] audit: type=1804 audit(1588111463.693:20): pid=16436 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir727132370/syzkaller.FX5yAf/128/file0/bus" dev="ramfs" ino=54745 res=1 [ 1003.835557] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 22:04:23 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1003.889782] binder: 16444:16479 ioctl c0306201 20000280 returned -14 [ 1003.911295] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 22:04:23 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1003.967986] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 [ 1004.030634] audit: type=1804 audit(1588111463.953:21): pid=16503 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir727132370/syzkaller.FX5yAf/129/file0/bus" dev="ramfs" ino=55683 res=1 22:04:24 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1004.078860] binder: 16518:16524 ioctl c0306201 20000280 returned -14 [ 1004.081461] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 22:04:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)) 22:04:24 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000100)={r5, @in6={{0xa, 0x4e24, 0x7ff0000, @dev={0xfe, 0x80, [], 0x19}, 0x2}}}, &(0x7f0000000080)=0x84) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r6, 0x400455c8, 0x0) ioctl$TIOCSETD(r6, 0x5412, &(0x7f0000000000)=0x2) 22:04:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1004.153495] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 [ 1004.221010] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 [ 1004.236903] binder: 16533:16537 ioctl c0306201 20000280 returned -14 22:04:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1004.276353] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 [ 1004.288884] audit: type=1804 audit(1588111464.203:22): pid=16540 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir727132370/syzkaller.FX5yAf/130/file0/bus" dev="ramfs" ino=55710 res=1 22:04:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1004.320133] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16374 comm=syz-executor.0 22:04:24 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039000800", 0x20}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:04:24 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1004.445258] binder: 16568:16580 ioctl c0306201 20000280 returned -14 [ 1004.454591] Bluetooth: hci0: Frame reassembly failed (-84) 22:04:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:24 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1004.604162] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1004.609776] binder: 16628:16636 ioctl c0306201 20000280 returned -14 22:04:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:24 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, 0x0) [ 1004.783488] binder: 16671:16694 ioctl c0306201 20000280 returned -14 [ 1004.875610] binder: 16702:16706 ioctl c0306201 20000280 returned -14 [ 1006.465704] Bluetooth: hci0: command 0x1003 tx timeout [ 1006.472252] Bluetooth: hci0: sending frame failed (-49) [ 1008.555387] Bluetooth: hci0: command 0x1001 tx timeout [ 1008.560814] Bluetooth: hci0: sending frame failed (-49) [ 1010.625293] Bluetooth: hci0: command 0x1009 tx timeout 22:04:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000080)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:34 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, 0x0, 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:34 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:04:34 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa843089100000039000800", 0x20}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) [ 1015.039314] binder: 16864:16875 ioctl c0306201 20000280 returned -14 [ 1015.057723] Bluetooth: hci0: Frame reassembly failed (-84) 22:04:35 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:35 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, 0x0, 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1015.110320] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1015.165272] selinux_nlmsg_perm: 52 callbacks suppressed [ 1015.165288] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.209157] binder: 16909:16912 ioctl c0306201 20000280 returned -14 22:04:35 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1015.263741] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 22:04:35 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, 0x0, 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1015.317517] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.340068] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.365909] binder: 16954:16966 ioctl c0306201 20000280 returned -14 [ 1015.373422] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 22:04:35 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1015.423595] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.452401] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 22:04:35 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1015.479992] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.516533] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1015.559617] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16893 comm=syz-executor.0 [ 1017.104149] Bluetooth: hci0: command 0x1003 tx timeout [ 1017.109535] Bluetooth: hci0: sending frame failed (-49) [ 1019.183934] Bluetooth: hci0: command 0x1001 tx timeout [ 1019.189323] Bluetooth: hci0: sending frame failed (-49) [ 1021.263735] Bluetooth: hci0: command 0x1009 tx timeout 22:04:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={@rand_addr, @multicast2, 0x0}, &(0x7f0000000100)=0xc) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in=@local, @in6=@local, 0x4e22, 0xce8f, 0x4e24, 0x8000, 0x2, 0x20, 0x60, 0x3c, r3, r5}, {0x0, 0x9, 0x4, 0x5, 0x1e34, 0x40, 0x8, 0xed3}, {0x4, 0xffffffffffff8000, 0x0, 0x6}, 0x8001, 0x6e6bb0, 0x1, 0x1, 0x2, 0x2}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d4, 0xff}, 0x2, @in=@private=0xa010100, 0x3500, 0x2, 0x0, 0x20, 0xffffffff, 0x9, 0x2}}, 0xe8) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:45 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:04:45 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:45 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x80000000000004) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:04:45 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r1, 0x0, 0x30005, 0x0) 22:04:45 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1025.301402] Bluetooth: hci0: Frame reassembly failed (-84) 22:04:45 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1025.372881] binder: 17086:17092 ioctl c0306201 0 returned -14 22:04:45 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 22:04:45 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:45 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1025.536117] binder: 17149:17156 ioctl c0306201 0 returned -14 22:04:45 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1025.618010] binder: 17175:17180 ioctl c0306201 0 returned -14 [ 1027.342774] Bluetooth: hci0: command 0x1003 tx timeout [ 1027.348175] Bluetooth: hci0: sending frame failed (-49) [ 1029.422497] Bluetooth: hci0: command 0x1001 tx timeout [ 1029.428031] Bluetooth: hci0: sending frame failed (-49) [ 1031.502280] Bluetooth: hci0: command 0x1009 tx timeout 22:04:55 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:55 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:04:55 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:55 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r1, 0x0, 0x30005, 0x0) 22:04:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:04:55 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:04:55 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1035.556428] binder: 17232:17243 ioctl c0306201 0 returned -14 22:04:55 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:04:55 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:04:55 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:04:55 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) r5 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000200)='NET_DM\x00') sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x100, 0x70bd29, 0x0, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x8051) sendmsg$NET_DM_CMD_START(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x300, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4041}, 0x6d225d5101d14a63) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000100)={0x0, @reserved}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:04:55 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) [ 1037.511373] Bluetooth: hci0: command 0x1003 tx timeout [ 1037.516780] Bluetooth: hci0: sending frame failed (-49) [ 1037.901315] Bluetooth: hci1: command 0x1003 tx timeout [ 1037.906832] Bluetooth: hci1: sending frame failed (-49) [ 1039.581247] Bluetooth: hci0: command 0x1001 tx timeout [ 1039.586683] Bluetooth: hci0: sending frame failed (-49) [ 1039.981161] Bluetooth: hci1: command 0x1001 tx timeout [ 1039.986550] Bluetooth: hci1: sending frame failed (-49) [ 1041.660907] Bluetooth: hci0: command 0x1009 tx timeout [ 1042.060912] Bluetooth: hci1: command 0x1009 tx timeout 22:05:05 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x15) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:05:05 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:05:05 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r1, 0x0, 0x30005, 0x0) 22:05:05 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:05:05 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:05 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 1045.805194] binder: 17285:17305 ioctl c0306201 0 returned -14 22:05:05 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:05:05 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:05:06 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) pwrite64(r0, &(0x7f00000002c0)="8b46e59fb5a28ab67035a5ae55ecf57bfe7c2fcce0c8bc51729336ec111943419e7d2d46770252b8cabed71ed9048253264d46b16edc77b66a5fa162be0fc8368425ef378206e378e693ad47ad4587e2fc3a1b3f3285ca2cae49ac478d88dbaeb0b8d6cc3d988cb5327f8f90b549b59df89f7648dfdc69db64bdec085a3f3f2cc82b845d360da69fbd03b7c76bfcd20ce5c9bdec8767c7419829a553684eda6ed9f331e21e8666ed796110", 0xab, 0xe000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380)='/dev/nullb0\x00', 0x250080, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') getsockopt$netlink(r2, 0x10e, 0x8, &(0x7f0000000200)=""/183, &(0x7f0000000140)=0xb7) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) getsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000000)=0x2) 22:05:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) [ 1046.434287] Bluetooth: hci0: Frame reassembly failed (-84) [ 1046.471837] binder: 17455:17457 unknown command 25344 [ 1046.478255] binder_alloc: 17447: binder_alloc_buf, no vma [ 1046.483982] binder: 17455:17457 ioctl c0306201 20000280 returned -22 [ 1046.514682] binder: 17447:17456 ioctl c0306201 20000280 returned -14 22:05:06 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:05:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:05:06 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) [ 1046.627601] binder: 17460:17463 unknown command 25344 [ 1046.633181] binder: 17460:17463 ioctl c0306201 20000280 returned -22 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) [ 1046.674550] binder: 17461:17469 ioctl c0306201 0 returned -14 [ 1046.745068] binder: 17472:17474 unknown command 25344 [ 1046.757219] binder: 17472:17474 ioctl c0306201 20000280 returned -22 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:05:06 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) [ 1048.459949] Bluetooth: hci0: command 0x1003 tx timeout [ 1048.465345] Bluetooth: hci0: sending frame failed (-49) [ 1050.549717] Bluetooth: hci0: command 0x1001 tx timeout [ 1050.555713] Bluetooth: hci0: sending frame failed (-49) [ 1052.619485] Bluetooth: hci0: command 0x1009 tx timeout 22:05:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:16 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) r5 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000200)='NET_DM\x00') sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x100, 0x70bd29, 0x0, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x8051) sendmsg$NET_DM_CMD_START(r3, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x300, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4041}, 0x6d225d5101d14a63) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000100)={0x0, @reserved}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:05:16 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:05:16 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:05:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x406143, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x18, r1, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:05:16 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1056.637819] Bluetooth: hci0: Frame reassembly failed (-84) [ 1056.693482] binder_alloc: 17506: binder_alloc_buf, no vma [ 1056.711914] binder: 17506:17524 ioctl c0306201 20000280 returned -14 22:05:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x19) 22:05:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100)='devlink\x00') r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040841) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x84000}, 0x8040) [ 1056.970041] Bluetooth: hci1: Frame reassembly failed (-84) 22:05:17 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:17 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:05:17 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 22:05:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1057.572552] binder_alloc: 17549: binder_alloc_buf, no vma [ 1057.585229] binder: 17549:17555 ioctl c0306201 20000280 returned -14 [ 1058.698675] Bluetooth: hci0: command 0x1003 tx timeout [ 1058.704102] Bluetooth: hci0: sending frame failed (-49) [ 1059.018638] Bluetooth: hci1: command 0x1003 tx timeout [ 1059.024184] Bluetooth: hci1: sending frame failed (-49) [ 1060.778444] Bluetooth: hci0: command 0x1001 tx timeout [ 1060.785069] Bluetooth: hci0: sending frame failed (-49) [ 1061.098412] Bluetooth: hci1: command 0x1001 tx timeout [ 1061.104070] Bluetooth: hci1: sending frame failed (-49) [ 1062.858197] Bluetooth: hci0: command 0x1009 tx timeout [ 1063.178229] Bluetooth: hci1: command 0x1009 tx timeout 22:05:26 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:ldconfig_exec_t:s0\x00', 0x25) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x1c, 0x1d, 0x1}, 0x1c}}, 0x0) 22:05:26 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:26 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:05:26 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x30005, 0x0) 22:05:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1066.880378] audit: type=1400 audit(1588111526.812:23): avc: denied { create } for pid=17577 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=netlink_route_socket permissive=1 [ 1066.919685] binder: 17575:17585 ioctl c0306201 20000280 returned -14 22:05:26 executing program 5: [ 1066.936206] audit: type=1400 audit(1588111526.832:24): avc: denied { write } for pid=17577 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=netlink_route_socket permissive=1 [ 1066.960602] audit: type=1400 audit(1588111526.832:25): avc: denied { nlmsg_write } for pid=17577 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=netlink_route_socket permissive=1 22:05:26 executing program 5: [ 1067.002658] audit: type=1400 audit(1588111526.832:26): avc: denied { create } for pid=17577 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=unix_dgram_socket permissive=1 [ 1067.026296] audit: type=1400 audit(1588111526.842:27): avc: denied { ioctl } for pid=17577 comm="syz-executor.5" path="socket:[57912]" dev="sockfs" ino=57912 ioctlcmd=0x8912 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=unix_dgram_socket permissive=1 22:05:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:05:27 executing program 5: 22:05:27 executing program 5: 22:05:27 executing program 5: [ 1067.518118] Bluetooth: hci0: Frame reassembly failed (-84) 22:05:27 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:27 executing program 5: 22:05:27 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x30005, 0x0) 22:05:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:05:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:27 executing program 5: 22:05:27 executing program 5: [ 1067.810430] binder: 17615:17626 ioctl c0306201 20000280 returned -14 22:05:27 executing program 5: [ 1069.577262] Bluetooth: hci0: command 0x1003 tx timeout [ 1069.583695] Bluetooth: hci0: sending frame failed (-49) [ 1071.657118] Bluetooth: hci0: command 0x1001 tx timeout [ 1071.662494] Bluetooth: hci0: sending frame failed (-49) [ 1073.736884] Bluetooth: hci0: command 0x1009 tx timeout 22:05:37 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f0000000100)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) syz_open_pts(r1, 0x1) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000080)={0x3f, 0x0, 0x5, 0x3, 0x18, "2d4a44f91749ea29"}) 22:05:37 executing program 5: 22:05:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:05:37 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:37 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$netlink(0x10, 0x3, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x30005, 0x0) 22:05:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:37 executing program 5: [ 1077.802657] Bluetooth: hci0: Frame reassembly failed (-84) [ 1077.809433] binder: 17651:17662 ioctl c0306201 20000280 returned -14 22:05:37 executing program 5: 22:05:37 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000000a01010000010000000000020000080900010073797a30000000000900010073797a300000000008000240bc"], 0x1}}, 0x0) splice(r0, 0x0, r1, 0x0, 0xffffffff, 0x0) [ 1077.951587] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.5'. 22:05:37 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000000a01010000010000000000020000080900010073797a30000000000900010073797a300000000008000240bc"], 0x1}}, 0x0) splice(r0, 0x0, r1, 0x0, 0xffffffff, 0x0) [ 1078.098758] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.5'. 22:05:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r3 = accept(r0, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000002780)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="ea", 0x1}], 0x1, &(0x7f0000000180)=[@assoc={0x18}], 0x18}], 0x1, 0x0) 22:05:38 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x105002, 0x0) sendfile(r0, r1, 0x0, 0x80001d00c0d0) [ 1079.816114] Bluetooth: hci0: command 0x1003 tx timeout [ 1079.821511] Bluetooth: hci0: sending frame failed (-49) [ 1081.895958] Bluetooth: hci0: command 0x1001 tx timeout [ 1081.901337] Bluetooth: hci0: sending frame failed (-49) [ 1083.975563] Bluetooth: hci0: command 0x1009 tx timeout 22:05:47 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000080)) 22:05:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) connect$inet(r2, &(0x7f0000000280), 0x10) 22:05:47 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x30005, 0x0) 22:05:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:05:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00'], 0x2) sendfile(r7, r7, &(0x7f0000000240), 0x7fff) 22:05:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1d, 0x0, "2461758a5264d9a14fb62fe6bce0eeb5025264c73c839e09f5ff08cccc6e3ffd7477f28557a8556964d283b24c2a2bb1dcc5a8d735eec48df90a55e5c0b3a337860cfd677448d1258641934ef7302d02"}, 0xd8) setsockopt$inet_tcp_int(r2, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) connect$inet(r2, &(0x7f0000000280), 0x10) [ 1088.036434] Bluetooth: hci0: Frame reassembly failed (-90) [ 1088.062505] binder_alloc: 17708: binder_alloc_buf, no vma [ 1088.100778] binder: 17708:17725 ioctl c0306201 20000280 returned -14 22:05:48 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x30005, 0x0) 22:05:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(0xffffffffffffffff, r7, &(0x7f0000000240), 0x7fff) 22:05:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:05:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xc, 0x0, &(0x7f0000000200)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS3\x00', 0x802, 0x0) sendfile(r1, r0, 0x0, 0x7ffff000) [ 1088.878379] binder_alloc: 17727: binder_alloc_buf, no vma [ 1088.884042] binder: 17727:17735 ioctl c0306201 20000280 returned -14 [ 1090.064799] Bluetooth: hci0: command 0x1003 tx timeout [ 1090.070177] Bluetooth: hci0: sending frame failed (-49) [ 1092.134621] Bluetooth: hci0: command 0x1001 tx timeout [ 1092.140042] Bluetooth: hci0: sending frame failed (-49) [ 1094.214369] Bluetooth: hci0: command 0x1009 tx timeout 22:05:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(0xffffffffffffffff, r7, &(0x7f0000000240), 0x7fff) 22:05:58 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x30005, 0x0) 22:05:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:05:58 executing program 5: 22:05:58 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x200f) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TCSBRK(r1, 0x5409, 0x2) 22:05:58 executing program 5: 22:05:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(0xffffffffffffffff, r7, &(0x7f0000000240), 0x7fff) 22:05:58 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES16=r2, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000100)={0x0, 0x8, 0x638b, 0x2, 0x10000, 0x1ff}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCSETD(r3, 0x5412, &(0x7f0000000000)=0x11) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000200)=0x1) 22:05:58 executing program 5: [ 1098.260725] binder_alloc: 17765: binder_alloc_buf, no vma [ 1098.289456] binder: 17765:17778 ioctl c0306201 20000280 returned -14 22:05:58 executing program 5: 22:05:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, 0xffffffffffffffff, &(0x7f0000000240), 0x7fff) [ 1098.402887] Bluetooth: hci0: Frame reassembly failed (-84) 22:05:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:05:58 executing program 5: 22:05:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, 0xffffffffffffffff, &(0x7f0000000240), 0x7fff) 22:05:59 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:05:59 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 22:05:59 executing program 5: 22:05:59 executing program 5: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x6, 0x0, 0x400000000000000, 0x9]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x4e20, @remote}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000640)={[], 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) 22:05:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, 0xffffffffffffffff, &(0x7f0000000240), 0x7fff) [ 1099.150358] binder_alloc: 17800: binder_alloc_buf, no vma [ 1099.158490] binder: 17800:17811 ioctl c0306201 20000280 returned -14 [ 1100.463559] Bluetooth: hci0: command 0x1003 tx timeout [ 1100.469001] Bluetooth: hci0: sending frame failed (-49) [ 1102.533358] Bluetooth: hci0: command 0x1001 tx timeout [ 1102.540809] Bluetooth: hci0: sending frame failed (-49) [ 1104.613184] Bluetooth: hci0: command 0x1009 tx timeout 22:06:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:06:08 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, 0x0, 0x7fff) 22:06:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61128c000000000061138c0000000000bf2000000000000015000000080000002d0301000000000095000000000000006916000000000000bf67000000000000350600000fff07086706000002000000070300000ee60060bf050000000000004f650000000000006507f9ff01000000070700004c0000005f75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000000500000000000000950000000000000032ed3c5be9525db67754bb12fe3054ac69a5864e764f9914953170d2d7ffffff8ecf264e0f84f9f17d3c30e3c7bdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703d6c4f6f3be4b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546c087431d7700000006e7c955cfa1f6ab689fde4de4e63ede20271a51445dc8da39e5b0ab70100010000000000d048cd6002d4519af619e3cca4d69e0dee5eb106774a8f3e6916df85aaf34c4756ad3a6d74ec88158f0200000000c8fb735fd552bdc206004aeb0743eb2dc819b6cf5c8ac86d8a297dff0445a13d0045fb3cda32a673a6bb55d8c85f21dce431e56723888fb126a163f16fb2ad9bc1172ba7cbebe174aba210d702a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67a993716dbf580469f62ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000004000000000000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d022cf74686e9fbe2562671cd47840a7afaab43176e65ec1118d46d1e827f3472f4445d253887a5ad103649afa17690884f8d2001e03a651bb96589a7eab04871bc47287cd313f00000000000000407d00000000000000000000c59050647802cf86f10000005f37d83f84e98a52fbbecd106425563d80bd0d0d703f37ca363f601ae899a53f6715a0a62a34b0c94cce699452050000000000000026a0f6a5480a55c22fe394ac000000000000000000000000000000437d57defb79ea6a58bc3eeed729a2f95e1d6a1fc3857ff51b1e3ee000000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) 22:06:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:06:08 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) [ 1109.106810] Bluetooth: hci0: Frame reassembly failed (-84) 22:06:09 executing program 5: getsockopt$IP_SET_OP_GET_BYNAME(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000080)={0x6, 0x7, 'syz2\x00'}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRES16, @ANYBLOB], 0x2}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="1600", @ANYRES16=r3, @ANYBLOB], 0x3}}, 0x0) ioctl$VHOST_GET_VRING_BASE(0xffffffffffffffff, 0xc008af12, &(0x7f0000000040)) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)}, 0x4000000) bind$alg(0xffffffffffffffff, &(0x7f0000000940)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40086607, &(0x7f0000000080)) 22:06:09 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, 0x0, 0x7fff) [ 1109.154091] binder_alloc: 17848: binder_alloc_buf, no vma [ 1109.185942] binder: 17848:17869 ioctl c0306201 20000280 returned -14 22:06:09 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, 0x0, 0x7fff) 22:06:09 executing program 5: getsockopt$IP_SET_OP_GET_BYNAME(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000080)={0x6, 0x7, 'syz2\x00'}, 0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRES16, @ANYBLOB], 0x2}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="1600", @ANYRES16=r3, @ANYBLOB], 0x3}}, 0x0) ioctl$VHOST_GET_VRING_BASE(0xffffffffffffffff, 0xc008af12, &(0x7f0000000040)) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)}, 0x4000000) bind$alg(0xffffffffffffffff, &(0x7f0000000940)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40086607, &(0x7f0000000080)) 22:06:09 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x0) 22:06:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x14, 0x1, 0x1, 0x101}, 0x14}}, 0x0) [ 1111.172294] Bluetooth: hci0: command 0x1003 tx timeout [ 1111.177782] Bluetooth: hci0: sending frame failed (-49) [ 1113.252131] Bluetooth: hci0: command 0x1001 tx timeout [ 1113.257803] Bluetooth: hci0: sending frame failed (-49) [ 1115.331898] Bluetooth: hci0: command 0x1009 tx timeout 22:06:19 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x0) 22:06:19 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x76, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x0, 0x0) 22:06:19 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:06:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) socket$inet6(0xa, 0x3, 0x80000000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:19 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5500000018007f5300fe01b2a4a280930a600000ffa84308910000003900080008", 0x21}], 0x1}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 22:06:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) r5 = accept$inet6(r3, 0x0, &(0x7f0000000200)) fsetxattr$security_ima(r5, &(0x7f0000000240)='security.ima\x00', &(0x7f0000000280)=@v2={0x3, 0x1, 0xf, 0x2, 0xa2, "ead7af5ac118f94fac2e204697c25f0450ada19c62564985d47d66c4a0620ce459dccb95751a0e4fc95651286ff0019346ef9338b54b24cb78e6776cab09a86f9a349c625acb49b253fc1241f16de08752b96749a0a5e2b61c59f2da1143d5b8ae450c164ac0ae6e5317a03ef6f14e838e09cd52cee346137e202e4b8c94e4ed46f5928adec6093add6ed89d1479f8651282aa871c861d502222f2c12fd168fb67da"}, 0xab, 0x3) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r2, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_open_procfs(r2, &(0x7f0000000140)='net/connector\x00') r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r7, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r6, &(0x7f00000017c0), 0x218, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x11) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:06:19 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x2000000000000011, 0x2, r1, 0x0) r3 = fanotify_init(0x0, 0x0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x1, 0x20, r4, 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r7, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x3) sendfile(r7, r7, &(0x7f0000000240), 0x0) [ 1119.398511] binder_alloc: 17918: binder_alloc_buf, no vma [ 1119.437546] binder: 17918:17936 ioctl c0306201 20000280 returned -14 22:06:19 executing program 5: r0 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x3}, 0x0, 0xfffffffffffffffc, 0x100}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000500)="8d03ecf28f144d44", 0x8}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x1) syz_genetlink_get_family_id$nl80211(0x0) write$P9_RCLUNK(r3, &(0x7f0000000000)={0x7, 0x79, 0x41}, 0x7) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000300)=0x5b11, 0x4) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(0x0) close(0xffffffffffffffff) connect$inet(r4, 0x0, 0x0) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x0) ftruncate(r3, 0x80004) sendfile(r2, r3, 0x0, 0x8000fffffffe) 22:06:19 executing program 2: 22:06:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) write$vhci(r1, &(0x7f0000000080)=@HCI_ACLDATA_PKT={0x2, "b3f2ebe3aebe01"}, 0x8) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:06:19 executing program 2: 22:06:19 executing program 2: [ 1119.712444] Bluetooth: hci0: Frame reassembly failed (-84) 22:06:19 executing program 2: [ 1119.782541] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 22:06:19 executing program 2: 22:06:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:06:20 executing program 2: 22:06:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:20 executing program 0: 22:06:20 executing program 2: [ 1120.248143] binder_alloc: 17969: binder_alloc_buf, no vma [ 1120.255711] binder: 17969:17978 ioctl c0306201 20000280 returned -14 22:06:20 executing program 5: r0 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x3}, 0x0, 0xfffffffffffffffc, 0x100}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000500)="8d03ecf28f144d44", 0x8}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x1) syz_genetlink_get_family_id$nl80211(0x0) write$P9_RCLUNK(r3, &(0x7f0000000000)={0x7, 0x79, 0x41}, 0x7) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000300)=0x5b11, 0x4) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(0x0) close(0xffffffffffffffff) connect$inet(r4, 0x0, 0x0) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x0) ftruncate(r3, 0x80004) sendfile(r2, r3, 0x0, 0x8000fffffffe) 22:06:20 executing program 0: [ 1121.741205] Bluetooth: hci0: command 0x1003 tx timeout [ 1121.746614] Bluetooth: hci0: sending frame failed (-49) [ 1123.810924] Bluetooth: hci0: command 0x1001 tx timeout [ 1123.816357] Bluetooth: hci0: sending frame failed (-49) [ 1125.890718] Bluetooth: hci0: command 0x1009 tx timeout 22:06:30 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$NBD_SET_TIMEOUT(r1, 0xab09, 0x1000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:06:30 executing program 2: 22:06:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:30 executing program 0: 22:06:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:06:30 executing program 5: 22:06:30 executing program 2: 22:06:30 executing program 5: 22:06:30 executing program 0: [ 1130.228340] Bluetooth: hci0: Frame reassembly failed (-84) 22:06:30 executing program 2: [ 1130.275806] binder_alloc: 18009: binder_alloc_buf, no vma [ 1130.285058] binder: 18011:18024 unknown command 25344 22:06:30 executing program 0: 22:06:30 executing program 5: [ 1130.329221] binder: 18009:18025 ioctl c0306201 20000280 returned -14 [ 1130.340315] binder: 18011:18024 ioctl c0306201 20000280 returned -22 [ 1132.289959] Bluetooth: hci0: command 0x1003 tx timeout [ 1132.295702] Bluetooth: hci0: sending frame failed (-49) [ 1134.369763] Bluetooth: hci0: command 0x1001 tx timeout [ 1134.375140] Bluetooth: hci0: sending frame failed (-49) [ 1136.449515] Bluetooth: hci0: command 0x1009 tx timeout 22:06:40 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x12) 22:06:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:06:40 executing program 0: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f00000001c0)='systemem0md5sum$\x00 \x92\xc1\xf9\x82%\xa1\xaf\b\x86\x85;\x91\xeb2~\x83\'\xfd\x84\x02\x18\xa3S\xc9\xdd\xb5c\n\xdfKe\xa8\xeb\x95\x00\xa4\xe6\xf6\'>\xed\xfaK\x8d\x8e`\xbb\xabB\x85\xba-1o\xc5Q\xb1l\x01\x87\xc0I\xfd\xa7\x14\xcf\xe0\xfa\x86\xe5\xa7\x1a\xa0 \xdc=\xecp\xf5<\xd5\xc7x2u\xeb\xf2n\x13\x97H\xfa!:+\xbc\x14\x91\xdd\x17\xe8h\xe3\x9d\x9f\x18\x11Y\x80\n*\xfe\xab\xfe\xd8u\xd1\f\xdb\x93\x1f\xf6y\x04\xd3\xc5\x9a\x03Y?B\x14\xb6:\x00\x99\x01\x11\x8b\x7f\x12\x19\'\x04>\xa4\xcd\xb0\xb8\xb2\x01\xf6\xb2Z\xae*p\x91v\xca:\xd4t\xd0\xf1\xdc+\x1c\xf2\xe8\x0e\xae\xa8\x8d\xd6u\xe6\')\xab\xf4\xb5?@P\xf0\xd8gh\xdf\xc7\xda\xfd\xa0!.\xed', 0x0) r1 = memfd_create(&(0x7f0000000140)='$.6/%cpuset]\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000e80)=ANY=[@ANYBLOB="7f454c46020000008000000000c4b40003"], 0x11) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0x0, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') 22:06:40 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) unshare(0x40000000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="6ffe000080000000000003000000580001800d0001007564703a73797a310000000044000400200001000a00000000000000422d003a0000000000002e01000000010063f300200002000a00000000000000fe800000000000009e1e8ad2000000bb0000000000ee84b12fd5b8a32435631c8e82e5530a7cca03e7836cfe6b589f63cc22a6d954bfff001dcc2ab6155eb4a09c19121f431864aca41b2bd87e378334be9afe93209b424dfccb68c7b73d825e48d801d89c36be38bbea8810d839a224b56a003f86cee64ef03d6124dec3dfc12d5f829a68988e5424c9230f9ee712a1a213ee2d0a40c459bf966f56b7c3ded72c27b350ace730f6567e4ad5c6293b984f9cf7cb457836b4ad1b55aff496b39919786cee8be2da9d78b4bd70188e014fbba83accf3ffb02d9ab941a6d23049d23743a8e176f50b5e91e948bea714983fc7bb95a971eca6ef32cc9ee13c6b24041b8b66e22af04b06bb94e16a61fc65046bf0e328787dd733"], 0x6c}}, 0x0) 22:06:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:06:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r0, 0x0, r1) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={0xffffffffffffffff, r2}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000150000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x8, 0x4, 0x0, 0x0, 0x22, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @dev={0xac, 0x14, 0x14, 0x1a}}, @timestamp}}}}, 0x0) [ 1140.474064] Bluetooth: hci0: Frame reassembly failed (-84) [ 1140.475138] Bluetooth: hci0: Frame reassembly failed (-84) [ 1140.486830] IPVS: ftp: loaded support on port[0] = 21 [ 1140.497905] binder_alloc: 18047: binder_alloc_buf, no vma [ 1140.509924] Started in network mode 22:06:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1140.529024] Own node identity 422d003a0000000000002e0100000001, cluster identity 4711 [ 1140.541004] binder: 18047:18067 ioctl c0306201 20000280 returned -14 [ 1140.573595] binder: 18049:18072 unknown command 25344 [ 1140.585908] New replicast peer: fe80:0000:0000:0000:9e1e:8ad2:0000:00bb [ 1140.587248] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 1140.597277] binder: 18049:18072 ioctl c0306201 20000280 returned -22 [ 1140.618705] Enabled bearer , priority 10 22:06:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:06:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1140.817009] IPVS: ftp: loaded support on port[0] = 21 22:06:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) dup2(r1, r0) 22:06:41 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) dup2(r1, r0) [ 1141.750033] 32-bit node address hash set to 3a2e2d42 [ 1142.528947] Bluetooth: hci0: command 0x1003 tx timeout [ 1142.534532] Bluetooth: hci0: sending frame failed (-49) [ 1144.608644] Bluetooth: hci0: command 0x1001 tx timeout [ 1144.614016] Bluetooth: hci0: sending frame failed (-49) [ 1146.688505] Bluetooth: hci0: command 0x1009 tx timeout 22:06:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) uname(&(0x7f0000000100)=""/226) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:06:50 executing program 5: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4ad2}, 0x10) write(r0, &(0x7f0000000080)="2400000012005f0214f9f407000904000200200000000000000000000800090000000000", 0x24) 22:06:50 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) dup2(r1, r0) 22:06:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:06:50 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x52, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 22:06:50 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) [ 1150.683212] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1150.703340] binder_alloc: 18149: binder_alloc_buf, no vma [ 1150.707046] Bluetooth: hci0: Frame reassembly failed (-84) [ 1150.730055] binder: 18149:18159 ioctl c0306201 20000280 returned -14 [ 1150.745566] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:06:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:06:50 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) [ 1150.789162] binder: 18151:18168 unknown command 25344 [ 1150.793384] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1150.800289] binder: 18151:18168 ioctl c0306201 20000280 returned -22 [ 1150.819816] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:06:50 executing program 5: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f00000001c0)='systemem0md5sum$\x00 \x92\xc1\xf9\x82%\xa1\xaf\b\x86\x85;\x91\xeb2~\x83\'\xfd\x84\x02\x18\xa3S\xc9\xdd\xb5c\n\xdfKe\xa8\xeb\x95\x00\xa4\xe6\xf6\'>\xed\xfaK\x8d\x8e`\xbb\xabB\x85\xba-1o\xc5Q\xb1l\x01\x87\xc0I\xfd\xa7\x14\xcf\xe0\xfa\x86\xe5\xa7\x1a\xa0 \xdc=\xecp\xf5<\xd5\xc7x2u\xeb\xf2n\x13\x97H\xfa!:+\xbc\x14\x91\xdd\x17\xe8h\xe3\x9d\x9f\x18\x11Y\x80\n*\xfe\xab\xfe\xd8u\xd1\f\xdb\x93\x1f\xf6y\x04\xd3\xc5\x9a\x03Y?B\x14\xb6:\x00\x99\x01\x11\x8b\x7f\x12\x19\'\x04>\xa4\xcd\xb0\xb8\xb2\x01\xf6\xb2Z\xae*p\x91v\xca:\xd4t\xd0\xf1\xdc+\x1c\xf2\xe8\x0e\xae\xa8\x8d\xd6u\xe6\')\xab\xf4\xb5?@P\xf0\xd8gh\xdf\xc7\xda\xfd\xa0!.\xed', 0x0) r1 = memfd_create(&(0x7f0000000140)='$.6/%cpuset]\x00', 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0x0, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000000)) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') 22:06:50 executing program 0: creat(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) [ 1150.919668] binder: 18174:18175 ioctl c0306201 20000280 returned -14 22:06:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1151.033028] binder: 18188:18191 ioctl c0306201 20000280 returned -14 [ 1152.777711] Bluetooth: hci0: command 0x1003 tx timeout [ 1152.784072] Bluetooth: hci0: sending frame failed (-49) [ 1154.847475] Bluetooth: hci0: command 0x1001 tx timeout [ 1154.852844] Bluetooth: hci0: sending frame failed (-49) [ 1156.927332] Bluetooth: hci0: command 0x1009 tx timeout 22:07:00 executing program 5: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000000)=""/191, 0xfffffed2, 0x0, 0x0, 0xffffffffffffff49) 22:07:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) 22:07:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:00 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r2 = getpgrp(0x0) fcntl$setown(r1, 0x8, r2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x0, r3}) 22:07:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:07:00 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x6, 0x4) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f0000000040)=0x6, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000080)={0x0, @time={0x7, 0x7}, 0x2, {0xff, 0x3}, 0x8d, 0x0, 0x3}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$TIOCSETD(r6, 0x5412, &(0x7f0000000140)=0x400c) 22:07:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1160.913792] binder: 18212:18215 ioctl c0306201 20000280 returned -14 22:07:00 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PIO_UNIMAP(r1, 0x541b, 0x0) 22:07:01 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1161.036083] binder: 18228:18231 ioctl c0306201 20000280 returned -14 22:07:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:01 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) ioctl$TCXONC(r1, 0x540a, 0x3) 22:07:01 executing program 5: clock_gettime(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffff7fffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x2800) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="8b", 0x1) recvmmsg(r1, &(0x7f0000006100)=[{{&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000340)=""/120, 0x6f}}], 0x400000000000653, 0x0, 0x0) vmsplice(r1, 0x0, 0x0, 0x9) socket(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000140), 0x0) 22:07:01 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1161.186560] binder: 18239:18241 ioctl c0306201 20000280 returned -14 22:07:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:01 executing program 2: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r0, 0xffffffffffffffff) [ 1161.317824] binder: 18250:18253 ioctl c0306201 20000280 returned -14 22:07:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) [ 1163.016628] Bluetooth: hci0: command 0x1003 tx timeout [ 1163.022152] Bluetooth: hci0: sending frame failed (-49) [ 1165.086460] Bluetooth: hci0: command 0x1001 tx timeout [ 1165.091908] Bluetooth: hci0: sending frame failed (-49) [ 1167.166327] Bluetooth: hci0: command 0x1009 tx timeout 22:07:11 executing program 2: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r0, 0xffffffffffffffff) 22:07:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:11 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814", 0x8d) vmsplice(r2, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) 22:07:11 executing program 5: perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) write$P9_RLERROR(0xffffffffffffffff, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) creat(&(0x7f0000000100)='./file0/../file0\x00', 0x126) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) recvfrom(r2, &(0x7f0000000140)=""/163, 0x100000345, 0x0, 0x0, 0x0) lseek(0xffffffffffffffff, 0x0, 0x1) sendto$unix(r2, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x429) recvfrom(r2, &(0x7f0000003240)=""/4096, 0x100000205, 0x0, 0x0, 0x415) ioctl$DRM_IOCTL_NEW_CTX(0xffffffffffffffff, 0x40086425, &(0x7f0000000180)) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f0000000400)={0x0, 0x1, &(0x7f00000002c0)=[0x1000], &(0x7f0000000300)=[0x9, 0x0, 0x0], 0x0, 0x1, 0xb27, &(0x7f0000000340)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYRES64], 0x1}}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 22:07:11 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:07:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = dup(r1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7fff}}, 0x44fc, 0x2}, &(0x7f0000000080)=0x90) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:07:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:11 executing program 2: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r0, 0xffffffffffffffff) [ 1171.201304] Bluetooth: hci0: Frame reassembly failed (-84) 22:07:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:11 executing program 2: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:11 executing program 2: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:11 executing program 2: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1171.443914] binder: 18314:18315 ioctl c0306201 20000280 returned -14 [ 1171.533648] binder: 18320:18322 ioctl c0306201 20000280 returned -14 22:07:11 executing program 0: pipe(&(0x7f0000000080)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2224, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) mmap$perf(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r1 = creat(&(0x7f0000000280)='./bus\x00', 0xc0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) lseek(r2, 0x7ffffc, 0x0) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="6faa7764a519f744", @ANYRES64]], 0x8) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f00000007c0)=ANY=[@ANYBLOB="00000000000000002942c178000000000000000000000000040000000000000001000000000000000000000000000000050000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000100000001000100"]) sendmmsg(r0, &(0x7f0000006d00), 0x800000000000237, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x0) 22:07:12 executing program 5: perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) write$P9_RLERROR(0xffffffffffffffff, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) creat(&(0x7f0000000100)='./file0/../file0\x00', 0x126) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = creat(0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) recvfrom(r2, &(0x7f0000000140)=""/163, 0x100000345, 0x0, 0x0, 0x0) lseek(0xffffffffffffffff, 0x0, 0x1) sendto$unix(r2, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x429) recvfrom(r2, &(0x7f0000003240)=""/4096, 0x100000205, 0x0, 0x0, 0x415) ioctl$DRM_IOCTL_NEW_CTX(0xffffffffffffffff, 0x40086425, &(0x7f0000000180)) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f0000000400)={0x0, 0x1, &(0x7f00000002c0)=[0x1000], &(0x7f0000000300)=[0x9, 0x0, 0x0], 0x0, 0x1, 0xb27, &(0x7f0000000340)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYRES64], 0x1}}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 22:07:12 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1173.245548] Bluetooth: hci0: command 0x1003 tx timeout [ 1173.250932] Bluetooth: hci0: sending frame failed (-49) [ 1175.325463] Bluetooth: hci0: command 0x1001 tx timeout [ 1175.330877] Bluetooth: hci0: sending frame failed (-49) [ 1177.405220] Bluetooth: hci0: command 0x1009 tx timeout 22:07:21 executing program 4: openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[], 0xfffffcaa) r2 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(r2, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x80000001, 0x0) 22:07:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:21 executing program 0: pipe(&(0x7f0000000080)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2224, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) mmap$perf(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r1 = creat(&(0x7f0000000280)='./bus\x00', 0xc0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040)) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) lseek(r2, 0x7ffffc, 0x0) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="6faa7764a519f744", @ANYRES64]], 0x8) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f00000007c0)=ANY=[@ANYBLOB="00000000000000002942c178000000000000000000000000040000000000000001000000000000000000000000000000050000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000100000001000100"]) sendmmsg(r0, &(0x7f0000006d00), 0x800000000000237, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x0) 22:07:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000100)={0x980000, 0x4, 0x97cb, r0, 0x0, &(0x7f0000000080)={0x980900, 0x8001, [], @value64=0xffffffff}}) ioctl$KDADDIO(r3, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:07:21 executing program 5: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000280)=""/1, 0x2}], 0x200000000000000f) [ 1181.422802] binder: 18361:18368 ioctl c0306201 20000280 returned -14 22:07:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:21 executing program 5: 22:07:21 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$CAN_RAW_FD_FRAMES(r1, 0x65, 0x5, &(0x7f0000000080), 0x4) 22:07:21 executing program 0: 22:07:21 executing program 5: [ 1181.669988] Bluetooth: hci0: Frame reassembly failed (-84) 22:07:22 executing program 4: 22:07:22 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:22 executing program 0: 22:07:22 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:22 executing program 5: 22:07:22 executing program 5: 22:07:22 executing program 0: 22:07:22 executing program 4: 22:07:22 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1183.734532] Bluetooth: hci0: command 0x1003 tx timeout [ 1183.739962] Bluetooth: hci0: sending frame failed (-49) [ 1185.804361] Bluetooth: hci0: command 0x1001 tx timeout [ 1185.809739] Bluetooth: hci0: sending frame failed (-49) [ 1187.884158] Bluetooth: hci0: command 0x1009 tx timeout 22:07:32 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="26040edde426c136f58be15faca4ec60"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r1, 0x4018ae51, &(0x7f0000000080)={0x4, 0xfffffffffffffe01, 0x638}) 22:07:32 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:32 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:32 executing program 5: 22:07:32 executing program 4: 22:07:32 executing program 0: 22:07:32 executing program 5: 22:07:32 executing program 4: 22:07:32 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:32 executing program 0: [ 1192.303749] Bluetooth: hci0: Frame reassembly failed (-84) 22:07:32 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:32 executing program 5: [ 1194.363422] Bluetooth: hci0: command 0x1003 tx timeout [ 1194.368867] Bluetooth: hci0: sending frame failed (-49) [ 1196.443230] Bluetooth: hci0: command 0x1001 tx timeout [ 1196.448637] Bluetooth: hci0: sending frame failed (-49) [ 1198.523046] Bluetooth: hci0: command 0x1009 tx timeout 22:07:42 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x1) 22:07:42 executing program 4: 22:07:42 executing program 0: 22:07:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:42 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:42 executing program 5: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4ad2}, 0x10) write(r0, &(0x7f0000000080)="2400000012005f0014f9f407000904000200200000000000000000000800090000000000", 0x24) 22:07:42 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0xffff000000000001, r0, 0x0) [ 1202.517482] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:07:42 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000002740)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0xa02) 22:07:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1202.585756] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:07:42 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000080)=0x2cd) 22:07:42 executing program 5: unshare(0x40000000) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="6ffe000080000000000003000000580001800d0001007564703a73797a310000000044000400200001000a00000000000000422d003a0000000000002e01000000010063f300200002000a00000000000000fe800000000000009e1e8ad2000000bb0000000000ee84b12fd5b8a32435631c8e82e5530a7cca03e7836cfe6b589f63cc22a6d954bfff001dcc2ab6155eb4a09c19121f431864aca41b2bd87e378334be9afe93209b424dfccb68c7b73d825e48d801d89c36be38bbea8810d839a224b56a003f86cee64ef03d6124dec3dfc12d5f829a68988e5424c9230f9ee712a1a213ee2d0a40c459bf966f56b7c3ded72c27b350ace730f6567e4ad5c6293b984f9cf7cb457836b4ad1b55aff496b39919786cee8be2da9d78b4bd70188e014fbba83accf3ffb02d9ab941a6d23049d23743a8e176f50b5e91e948bea714983fc7bb95a971eca6ef32cc9ee13c6b24041b8b66e22af04b06bb94e16a61fc65046bf0e328787dd733"], 0x6c}}, 0x0) 22:07:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:42 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100767469000c00028008000400e00000011400030069705f7674692fffffffffeb00000000"], 0x4c}}, 0x0) [ 1202.677584] binder: 18479:18482 ioctl c0306201 20000280 returned -14 22:07:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1202.771090] IPVS: ftp: loaded support on port[0] = 21 [ 1202.792838] Enabling of bearer rejected, already enabled [ 1202.800203] Bluetooth: hci0: Frame reassembly failed (-84) 22:07:42 executing program 0: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0xfe, 0x0, 0x2, 0x58270, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff80, 0x0, @perf_bp={0x0}, 0x120, 0x24, 0x0, 0x0, 0x5, 0x80000000, 0xffff}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0xe518f000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) socket$inet6(0xa, 0x3, 0x80000000000004) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r4, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000009c0)={r4, 0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000180)='lokeyring-system}-\x00'}, 0x30) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r6, r6, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r6, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r7, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000a00)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x1e4, 0x5}, 0x7b, 0xc0, 0x6, 0x5, r5, r7, 0x2}) ioctl$TCXONC(r3, 0x540a, 0x2) write$binfmt_aout(r3, &(0x7f0000000080)=ANY=[@ANYPTR64=&(0x7f0000000080)=ANY=[], @ANYBLOB="80d10ae1b4cb272bf260c33c8ac61da36f7a18ee77fa40d849657b9020ecc0bab03efa0a1a9498a3b4caee1aeadeedee261a2b61d2ff3d21000000", @ANYRES32=r4, @ANYRES64], 0x4e) 22:07:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1202.867741] binder: 18498:18499 ioctl c0306201 20000280 returned -14 22:07:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1202.995489] binder: 18501:18508 ioctl c0306201 20000280 returned -14 22:07:43 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1203.228395] IPVS: ftp: loaded support on port[0] = 21 22:07:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000180)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x16) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:07:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:43 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1203.538930] binder: 18557:18564 ioctl c0306201 20000280 returned -14 [ 1204.842628] Bluetooth: hci0: command 0x1003 tx timeout [ 1204.848294] Bluetooth: hci0: sending frame failed (-49) [ 1206.922267] Bluetooth: hci0: command 0x1001 tx timeout [ 1206.927715] Bluetooth: hci0: sending frame failed (-49) [ 1209.001996] Bluetooth: hci0: command 0x1009 tx timeout 22:07:53 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x0, 0x400000) setsockopt$llc_int(r1, 0x10c, 0x3, &(0x7f0000000100)=0x5, 0x4) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:07:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x545d, &(0x7f0000000000)=0x2) 22:07:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x545d, &(0x7f0000000000)=0x2) 22:07:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000180)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x16) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:07:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1213.419969] binder: 18583:18587 ioctl c0306201 20000280 returned -14 [ 1213.442613] Bluetooth: hci1: Frame reassembly failed (-84) 22:07:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000180)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x16) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:07:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:07:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:07:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1213.565927] binder: 18604:18607 ioctl c0306201 20000280 returned -14 22:07:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000180)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x16) [ 1213.669222] binder: 18613:18615 ioctl c0306201 0 returned -14 [ 1213.692697] binder: 18613:18615 ioctl c0306201 20000280 returned -14 [ 1215.481544] Bluetooth: hci2: command 0x1003 tx timeout [ 1215.486881] Bluetooth: hci1: command 0x1003 tx timeout [ 1215.486940] Bluetooth: hci2: sending frame failed (-49) [ 1215.492872] Bluetooth: hci0: command 0x1003 tx timeout [ 1215.503466] Bluetooth: hci1: sending frame failed (-49) [ 1215.512366] Bluetooth: hci0: sending frame failed (-49) [ 1217.561226] Bluetooth: hci0: command 0x1001 tx timeout [ 1217.566596] Bluetooth: hci1: command 0x1001 tx timeout [ 1217.566655] Bluetooth: hci0: sending frame failed (-49) [ 1217.574547] Bluetooth: hci2: command 0x1001 tx timeout [ 1217.577420] Bluetooth: hci1: sending frame failed (-49) [ 1217.584029] Bluetooth: hci2: sending frame failed (-49) [ 1219.641105] Bluetooth: hci2: command 0x1009 tx timeout [ 1219.641360] Bluetooth: hci1: command 0x1009 tx timeout [ 1219.646500] Bluetooth: hci0: command 0x1009 tx timeout 22:08:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x40000000000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:08:03 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) dup2(r1, r0) 22:08:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:03 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r3, 0x4b45, &(0x7f0000000180)=0x2) 22:08:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f00000001c0)={&(0x7f0000000100)=[0x80000000, 0x0, 0xfffffffc, 0xfffffffd, 0x9, 0x401], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, 0xe0e0e0e0}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0xfffffffd) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000080)) 22:08:03 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:03 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) dup2(r1, r0) 22:08:03 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) [ 1223.677732] binder: 18636:18639 ioctl c0306201 0 returned -14 [ 1223.700706] Bluetooth: hci0: Frame reassembly failed (-84) [ 1223.717877] binder: 18636:18639 ioctl c0306201 20000280 returned -14 22:08:03 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSKBMODE(r3, 0x4b45, &(0x7f0000000180)=0x2) [ 1223.753680] Bluetooth: hci1: Frame reassembly failed (-84) 22:08:03 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) syz_open_dev$tty20(0xc, 0x4, 0x0) 22:08:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:03 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, 0x0, 0x0) dup2(r1, r0) [ 1223.885825] binder: 18660:18663 ioctl c0306201 0 returned -14 [ 1223.918471] binder: 18660:18663 ioctl c0306201 20000280 returned -14 [ 1225.720473] Bluetooth: hci0: command 0x1003 tx timeout [ 1225.725890] Bluetooth: hci0: sending frame failed (-49) [ 1225.810369] Bluetooth: hci1: command 0x1003 tx timeout [ 1225.815779] Bluetooth: hci1: sending frame failed (-49) [ 1227.800226] Bluetooth: hci0: command 0x1001 tx timeout [ 1227.805646] Bluetooth: hci0: sending frame failed (-49) [ 1227.890217] Bluetooth: hci1: command 0x1001 tx timeout [ 1227.895633] Bluetooth: hci1: sending frame failed (-49) [ 1229.880037] Bluetooth: hci0: command 0x1009 tx timeout [ 1229.959975] Bluetooth: hci1: command 0x1009 tx timeout 22:08:13 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) getsockopt$IP_SET_OP_GET_BYNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000200)=0x28) 22:08:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280), 0x10) dup2(r1, r0) 22:08:13 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000100)=0x2) r2 = socket$kcm(0x10, 0x3, 0x0) link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') r3 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r2, 0x406, r3) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000080)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) getsockopt$packet_buf(r4, 0x107, 0x1, &(0x7f00000001c0)=""/232, &(0x7f00000002c0)=0xe8) 22:08:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) [ 1233.864417] binder: 18686:18692 ioctl c0306201 20000280 returned -14 22:08:13 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0x9, 0xfffffffa, 0x42, 0x0, 0x18, "c2be4431186b289353997facde7a3ea6b7da24"}) 22:08:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280), 0x10) dup2(r1, r0) [ 1233.909035] Bluetooth: hci0: Frame reassembly failed (-84) [ 1233.918574] Bluetooth: hci1: Frame reassembly failed (-84) 22:08:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1233.964206] Bluetooth: hci2: Frame reassembly failed (-84) 22:08:13 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) 22:08:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280), 0x10) dup2(r1, r0) 22:08:14 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) [ 1234.032772] binder: 18710:18711 ioctl c0306201 20000280 returned -14 22:08:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1234.134732] binder: 18718:18720 ioctl c0306201 20000280 returned -14 [ 1235.959435] Bluetooth: hci0: command 0x1003 tx timeout [ 1235.964835] Bluetooth: hci0: sending frame failed (-49) [ 1235.969361] Bluetooth: hci1: command 0x1003 tx timeout [ 1235.975578] Bluetooth: hci1: sending frame failed (-49) [ 1236.039405] Bluetooth: hci2: command 0x1003 tx timeout [ 1236.044828] Bluetooth: hci2: sending frame failed (-49) [ 1238.039299] Bluetooth: hci1: command 0x1001 tx timeout [ 1238.044786] Bluetooth: hci0: command 0x1001 tx timeout [ 1238.044882] Bluetooth: hci1: sending frame failed (-49) [ 1238.057310] Bluetooth: hci0: sending frame failed (-49) [ 1238.119260] Bluetooth: hci2: command 0x1001 tx timeout [ 1238.124667] Bluetooth: hci2: sending frame failed (-49) [ 1240.119073] Bluetooth: hci0: command 0x1009 tx timeout [ 1240.124414] Bluetooth: hci1: command 0x1009 tx timeout [ 1240.209071] Bluetooth: hci2: command 0x1009 tx timeout 22:08:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0xffffff88, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') preadv(r0, &(0x7f00000017c0), 0x315, 0x0) 22:08:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) 22:08:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) 22:08:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:24 executing program 1: rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="ae8ee7f5e9b98a3711f368412f60727095569145439d852d74911c1fda223b6a7a7334ed9c5b1f0e264a0ef7ba7ceaf215edb30c762db382aa093b039d5477580d4f305fed1e7af86610474e2a66b191d2dff25b912225963c22a11b900f42e552960d99c89999510cd71f0c1e26f8808cbd19958893685a034b86a84a6f87a56cd867e4a2037a49e6ff12ca5cffcd1a107392b9b7d36e9f707b6e4b061184b796ce30478d4fe2731ca3cbebc7d5a06619261cb1bda85838e02717d551d55b69fdde3ca018a6571fbad3beaeda84283627672c5338cc9c63a4f30afc5f3629471eaf026db04b45f6da001fc99b3dcbc62a6925c49a99660ee7a91bc319973a84f7cdd8b03dc3da05f147c1692141f444159a1745fa9281f3e24022b3092f2f6e361a868128e64c663dc282d44354acf7c2c44760f2f92f84d427587e2e01466f4bd6d12c62a17e17e2e4b2973f33b5b896027fa97c000000000000", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)={'#! ', './file0', [{0x20, 'lo^posix_acl_accesscgroup[eth0nodevnodevlo#ppp0'}], 0xa, "a68ccdf49070726e4f8d85402e3dd1bd3025428fd05ea86b3d36bc2f16d162a0052245e507ba2665b11baadfa8c5a763afab3286888a3730f3d0c24bec868dd96fa0ad4f43ee3e13a87a649599e7e875259c05bda5"}, 0x90) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:08:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) [ 1244.171033] binder: 18747:18754 ioctl c0306201 20000280 returned -14 [ 1244.186372] Bluetooth: hci0: Frame reassembly failed (-84) 22:08:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) 22:08:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:24 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x749b01, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x84000, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x775a58968b14b45d, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xc) syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r3, 0x540a, 0x2) ioctl$KDADDIO(r3, 0x400455c8, 0x1000000000f8) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x10000012) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f00000000c0)={0x0, 0xa, 0x0, "66552867bb97ec1498f4548c7d7c91b9fdba38a1ef71900f427233811f1290fb"}) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x102, 0x0) accept4$unix(r6, 0x0, &(0x7f0000000240), 0x0) 22:08:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(0xffffffffffffffff, r0) [ 1244.385013] binder: 18766:18767 ioctl c0306201 20000280 returned -14 22:08:24 executing program 0 (fault-call:11 fault-nth:0): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:24 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, 0xffffffffffffffff) 22:08:24 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x20000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x14, r2, 0x4, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x3b, 0xffff0000, 0x1}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000140)={r3, 0x4}, 0x8) [ 1244.655214] binder: 18785:18789 ioctl c0306201 20000280 returned -14 [ 1244.715822] Bluetooth: hci1: Frame reassembly failed (-90) [ 1244.751787] FAULT_INJECTION: forcing a failure. [ 1244.751787] name failslab, interval 1, probability 0, space 0, times 0 [ 1244.774388] CPU: 1 PID: 18800 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1244.782318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1244.791690] Call Trace: [ 1244.794303] dump_stack+0x188/0x20d [ 1244.797989] should_fail.cold+0xa/0x1b [ 1244.801915] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1244.807044] ? __lock_is_held+0xad/0x140 [ 1244.811142] __should_failslab+0x115/0x180 [ 1244.815394] should_failslab+0x5/0xf [ 1244.819221] kmem_cache_alloc_trace+0x2c6/0x7a0 [ 1244.823985] binder_inc_ref_for_node+0x208/0xc20 [ 1244.828770] binder_thread_write+0x140d/0x2a00 [ 1244.833374] ? mark_held_locks+0xf0/0xf0 [ 1244.837444] ? unwind_next_frame+0xd01/0x18a0 [ 1244.841952] ? binder_transaction+0x6ca0/0x6ca0 [ 1244.846644] ? find_held_lock+0x2d/0x110 [ 1244.850718] ? __might_fault+0x11f/0x1d0 [ 1244.854795] ? lock_downgrade+0x740/0x740 [ 1244.858964] ? __might_fault+0x192/0x1d0 [ 1244.863040] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1244.868426] ? binder_thread_write+0x2a00/0x2a00 [ 1244.873195] ? avc_ss_reset+0x180/0x180 [ 1244.877204] ? _raw_spin_unlock+0x29/0x40 [ 1244.881368] ? binder_get_thread+0x17a/0x7c0 [ 1244.885795] binder_ioctl+0x360/0x100f [ 1244.889701] ? mark_held_locks+0xf0/0xf0 [ 1244.893775] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1244.899341] ? proc_fail_nth_write+0x95/0x1d0 [ 1244.903859] ? proc_cwd_link+0x1d0/0x1d0 [ 1244.907956] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1244.913520] do_vfs_ioctl+0xcda/0x12e0 [ 1244.917453] ? selinux_file_ioctl+0x46c/0x5d0 [ 1244.921972] ? selinux_file_ioctl+0x125/0x5d0 [ 1244.926474] ? check_preemption_disabled+0x41/0x280 [ 1244.931776] ? ioctl_preallocate+0x200/0x200 [ 1244.936376] ? selinux_file_mprotect+0x600/0x600 [ 1244.941140] ? __fget+0x340/0x510 [ 1244.944590] ? iterate_fd+0x350/0x350 [ 1244.948395] ? security_file_ioctl+0x6c/0xb0 [ 1244.952809] ksys_ioctl+0x9b/0xc0 [ 1244.956417] __x64_sys_ioctl+0x6f/0xb0 [ 1244.960409] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1244.964999] do_syscall_64+0xf9/0x620 [ 1244.968799] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1244.973973] RIP: 0033:0x45c829 [ 1244.977176] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1244.996075] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1245.003796] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1245.011322] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1245.018594] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1245.025886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1245.033178] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1245.043115] binder: 18787:18800 ioctl c0306201 20000280 returned -14 [ 1246.198472] Bluetooth: hci0: command 0x1003 tx timeout [ 1246.203882] Bluetooth: hci0: sending frame failed (-49) [ 1246.758397] Bluetooth: hci1: command 0x1003 tx timeout [ 1246.763791] Bluetooth: hci1: sending frame failed (-49) [ 1248.278485] Bluetooth: hci0: command 0x1001 tx timeout [ 1248.283885] Bluetooth: hci0: sending frame failed (-49) [ 1248.838235] Bluetooth: hci1: command 0x1001 tx timeout [ 1248.843658] Bluetooth: hci1: sending frame failed (-49) [ 1250.358136] Bluetooth: hci0: command 0x1009 tx timeout [ 1250.918064] Bluetooth: hci1: command 0x1009 tx timeout 22:08:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, 0xffffffffffffffff) 22:08:34 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:34 executing program 0 (fault-call:11 fault-nth:1): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, 0xffffffffffffffff) [ 1254.354391] binder: 18815:18819 ioctl c0306201 20000280 returned -14 22:08:34 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1254.427496] FAULT_INJECTION: forcing a failure. [ 1254.427496] name failslab, interval 1, probability 0, space 0, times 0 [ 1254.476788] CPU: 0 PID: 18824 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1254.484718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1254.494088] Call Trace: [ 1254.496701] dump_stack+0x188/0x20d [ 1254.500353] should_fail.cold+0xa/0x1b [ 1254.504265] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1254.508652] binder: 18829:18833 ioctl c0306201 20000280 returned -14 [ 1254.509395] __should_failslab+0x115/0x180 [ 1254.509413] should_failslab+0x5/0xf 22:08:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1254.509431] kmem_cache_alloc_trace+0x2c6/0x7a0 [ 1254.528517] binder_transaction+0x8a6/0x6ca0 [ 1254.532958] ? mark_held_locks+0xf0/0xf0 [ 1254.537035] ? mark_held_locks+0xf0/0xf0 [ 1254.541109] ? find_held_lock+0x2d/0x110 [ 1254.545181] ? binder_thread_write+0x141a/0x2a00 [ 1254.549961] ? binder_thread_read+0x2d50/0x2d50 [ 1254.554647] ? lock_downgrade+0x740/0x740 [ 1254.558822] ? __might_fault+0x192/0x1d0 [ 1254.562901] binder_thread_write+0x5d3/0x2a00 [ 1254.567420] ? mark_held_locks+0xf0/0xf0 [ 1254.571494] ? unwind_next_frame+0xd01/0x18a0 [ 1254.576005] ? binder_transaction+0x6ca0/0x6ca0 [ 1254.580699] ? find_held_lock+0x2d/0x110 [ 1254.581595] binder: 18835:18837 ioctl c0306201 20000280 returned -14 [ 1254.585297] ? __might_fault+0x11f/0x1d0 [ 1254.585322] ? lock_downgrade+0x740/0x740 [ 1254.585345] ? __might_fault+0x192/0x1d0 [ 1254.585371] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1254.609663] ? binder_thread_write+0x2a00/0x2a00 [ 1254.614434] ? avc_ss_reset+0x180/0x180 [ 1254.618425] ? _raw_spin_unlock+0x29/0x40 [ 1254.622584] ? binder_get_thread+0x17a/0x7c0 [ 1254.627010] binder_ioctl+0x360/0x100f [ 1254.630911] ? mark_held_locks+0xf0/0xf0 [ 1254.634989] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1254.640536] ? proc_fail_nth_write+0x95/0x1d0 [ 1254.645039] ? proc_cwd_link+0x1d0/0x1d0 [ 1254.649130] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1254.654685] do_vfs_ioctl+0xcda/0x12e0 [ 1254.658590] ? selinux_file_ioctl+0x46c/0x5d0 [ 1254.663099] ? selinux_file_ioctl+0x125/0x5d0 [ 1254.667610] ? check_preemption_disabled+0x41/0x280 [ 1254.672646] ? ioctl_preallocate+0x200/0x200 [ 1254.677073] ? selinux_file_mprotect+0x600/0x600 [ 1254.681845] ? __fget+0x340/0x510 [ 1254.685319] ? iterate_fd+0x350/0x350 [ 1254.689145] ? security_file_ioctl+0x6c/0xb0 [ 1254.693568] ksys_ioctl+0x9b/0xc0 [ 1254.697039] __x64_sys_ioctl+0x6f/0xb0 [ 1254.700943] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1254.705542] do_syscall_64+0xf9/0x620 [ 1254.709367] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1254.714566] RIP: 0033:0x45c829 [ 1254.717767] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1254.736686] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1254.744437] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1254.751728] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1254.759026] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1254.759036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1254.759046] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1254.785142] binder: 18814:18824 ioctl c0306201 20000280 returned -14 22:08:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:34 executing program 2 (fault-call:4 fault-nth:0): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:08:34 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvram\x00', 0x200, 0x0) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000100)=""/147) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000280)='trusted.overlay.nlink\x00', &(0x7f00000002c0)={'U+'}, 0x16, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$RNDADDENTROPY(r3, 0x40085203, &(0x7f0000000300)={0xe, 0xc1, "d6e3e6c84d3f452b88d4fcd40655342f46289a6adb6858b56046b4cf8c7afd4943763a3f839d09b815b6e185255a0b69a22300903ea8add52fd9fe966563588b45417c814faaeff5ee1913a5d1647421269b14af0c203497ed16abcbab748b5f557c063da45bf3797bcb6cfeeba6ecba2328923c079f3762f5910e54a40a788fae044cf42466efd40af28417e3aa5f8ab7b87ff81a9d0df8594a113c94912c24e015f9602d053a5cae4ffb993fb88b797d2dda8c78af34b8fcffcb9d1c10bd3c7f"}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000400)={'TPROXY\x00'}, &(0x7f0000000440)=0x1e) recvfrom$unix(r1, &(0x7f00000001c0)=""/52, 0x34, 0x40000120, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e22}, 0x6e) [ 1254.995801] binder: 18854:18860 unknown command 25348 [ 1255.005175] FAULT_INJECTION: forcing a failure. [ 1255.005175] name failslab, interval 1, probability 0, space 0, times 0 [ 1255.016890] CPU: 0 PID: 18859 Comm: syz-executor.2 Not tainted 4.19.118-syzkaller #0 [ 1255.024782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1255.034174] Call Trace: [ 1255.036806] dump_stack+0x188/0x20d [ 1255.040460] should_fail.cold+0xa/0x1b [ 1255.044371] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1255.049489] ? _raw_spin_unlock_irqrestore+0x67/0xe0 [ 1255.054616] __should_failslab+0x115/0x180 [ 1255.058872] should_failslab+0x5/0xf [ 1255.062601] kmem_cache_alloc_node+0x55/0x730 [ 1255.067113] ? find_held_lock+0x2d/0x110 [ 1255.071302] ? tipc_nametbl_remove_publ+0x176/0x6f0 [ 1255.076378] __alloc_skb+0xba/0x5b0 [ 1255.078882] binder: 18854:18860 ioctl c0306201 20000200 returned -22 [ 1255.080021] ? skb_trim+0x180/0x180 [ 1255.080058] tipc_buf_acquire+0x28/0x100 [ 1255.089133] binder: 18854:18860 ioctl c0306201 20000280 returned -14 [ 1255.090156] named_prepare_buf+0x2d/0x3c0 [ 1255.090173] ? lockdep_hardirqs_on+0x196/0x5d0 [ 1255.090192] tipc_named_withdraw+0x33f/0x7b0 [ 1255.113842] tipc_nametbl_withdraw+0x574/0xa70 [ 1255.118443] tipc_sk_withdraw+0x431/0x550 [ 1255.122616] tipc_sk_leave+0x115/0x190 [ 1255.126513] ? tipc_sk_withdraw+0x550/0x550 [ 1255.130847] ? do_wait_intr_irq+0x270/0x270 [ 1255.135585] ? mark_held_locks+0xa6/0xf0 [ 1255.135604] ? __local_bh_enable_ip+0x159/0x270 [ 1255.144337] tipc_release+0xad/0xfc0 [ 1255.144358] ? __sock_release+0x86/0x2a0 [ 1255.144382] __sock_release+0xcd/0x2a0 [ 1255.144398] ? __sock_release+0x2a0/0x2a0 [ 1255.160323] sock_close+0x15/0x20 [ 1255.160343] __fput+0x2cd/0x890 [ 1255.167066] task_work_run+0x13f/0x1b0 [ 1255.170980] exit_to_usermode_loop+0x25a/0x2b0 [ 1255.175585] do_syscall_64+0x538/0x620 [ 1255.179605] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1255.184790] RIP: 0033:0x45c829 [ 1255.187973] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1255.206881] RSP: 002b:00007f3f13095c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1255.214599] RAX: 0000000000000003 RBX: 00000000004db200 RCX: 000000000045c829 [ 1255.221868] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 1255.229133] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1255.236393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 22:08:35 executing program 0 (fault-call:11 fault-nth:2): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:35 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40001, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1255.243665] R13: 000000000000009d R14: 00000000004c331f R15: 00007f3f130966d4 [ 1255.251074] Withdrawal distribution failure [ 1255.256424] Bluetooth: hci0: Frame reassembly failed (-90) 22:08:35 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140)=0x1, 0x4) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) [ 1255.350359] binder: 18875:18879 unknown command 25348 [ 1255.369220] binder: 18875:18879 ioctl c0306201 20000200 returned -22 22:08:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) [ 1255.394311] binder: 18875:18879 ioctl c0306201 20000280 returned -14 22:08:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0463"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1255.435234] FAULT_INJECTION: forcing a failure. [ 1255.435234] name failslab, interval 1, probability 0, space 0, times 0 22:08:35 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1255.491213] binder: 18888:18891 unknown command 25348 [ 1255.500107] binder: 18888:18891 ioctl c0306201 20000200 returned -22 [ 1255.514154] CPU: 0 PID: 18887 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1255.522060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1255.524485] binder: 18888:18891 ioctl c0306201 20000280 returned -14 [ 1255.531413] Call Trace: [ 1255.531438] dump_stack+0x188/0x20d [ 1255.531464] should_fail.cold+0xa/0x1b [ 1255.531482] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1255.531507] __should_failslab+0x115/0x180 [ 1255.531523] should_failslab+0x5/0xf [ 1255.531536] kmem_cache_alloc_trace+0x2c6/0x7a0 [ 1255.531555] ? __lockdep_init_map+0x100/0x5a0 [ 1255.570310] binder_transaction+0x926/0x6ca0 [ 1255.574740] ? mark_held_locks+0xf0/0xf0 [ 1255.578827] ? mark_held_locks+0xf0/0xf0 [ 1255.582902] ? find_held_lock+0x2d/0x110 [ 1255.586977] ? binder_thread_write+0x141a/0x2a00 [ 1255.591756] ? binder_thread_read+0x2d50/0x2d50 [ 1255.596554] ? lock_downgrade+0x740/0x740 [ 1255.600751] ? __might_fault+0x192/0x1d0 [ 1255.604829] binder_thread_write+0x5d3/0x2a00 [ 1255.609346] ? mark_held_locks+0xf0/0xf0 [ 1255.613419] ? unwind_next_frame+0xd01/0x18a0 [ 1255.617932] ? binder_transaction+0x6ca0/0x6ca0 [ 1255.622616] ? find_held_lock+0x2d/0x110 [ 1255.626691] ? __might_fault+0x11f/0x1d0 [ 1255.630767] ? lock_downgrade+0x740/0x740 [ 1255.634935] ? __might_fault+0x192/0x1d0 22:08:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1255.639007] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1255.644412] ? binder_thread_write+0x2a00/0x2a00 [ 1255.644429] ? avc_ss_reset+0x180/0x180 [ 1255.644449] ? _raw_spin_unlock+0x29/0x40 [ 1255.644470] ? binder_get_thread+0x17a/0x7c0 [ 1255.644491] binder_ioctl+0x360/0x100f [ 1255.644512] ? mark_held_locks+0xf0/0xf0 [ 1255.644527] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1255.644538] ? proc_fail_nth_write+0x95/0x1d0 [ 1255.644554] ? proc_cwd_link+0x1d0/0x1d0 [ 1255.683871] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1255.683888] do_vfs_ioctl+0xcda/0x12e0 22:08:35 executing program 2 (fault-call:4 fault-nth:1): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:08:35 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) [ 1255.683907] ? selinux_file_ioctl+0x46c/0x5d0 [ 1255.683923] ? selinux_file_ioctl+0x125/0x5d0 [ 1255.683939] ? check_preemption_disabled+0x41/0x280 [ 1255.683953] ? ioctl_preallocate+0x200/0x200 [ 1255.683969] ? selinux_file_mprotect+0x600/0x600 [ 1255.683985] ? __fget+0x340/0x510 [ 1255.684002] ? iterate_fd+0x350/0x350 [ 1255.684023] ? security_file_ioctl+0x6c/0xb0 [ 1255.684039] ksys_ioctl+0x9b/0xc0 [ 1255.684055] __x64_sys_ioctl+0x6f/0xb0 [ 1255.684070] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1255.684085] do_syscall_64+0xf9/0x620 [ 1255.684104] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1255.684115] RIP: 0033:0x45c829 [ 1255.684129] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1255.684136] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1255.684149] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1255.684156] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1255.684164] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1255.684171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1255.684179] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1255.694241] binder: 18878:18887 ioctl c0306201 20000280 returned -14 [ 1255.704805] binder: 18898:18900 unknown command 287492 [ 1255.704823] binder: 18898:18900 ioctl c0306201 20000200 returned -22 [ 1255.710886] binder: 18898:18900 ioctl c0306201 20000280 returned -14 [ 1255.798558] FAULT_INJECTION: forcing a failure. [ 1255.798558] name failslab, interval 1, probability 0, space 0, times 0 [ 1255.798576] CPU: 1 PID: 18906 Comm: syz-executor.2 Not tainted 4.19.118-syzkaller #0 [ 1255.798585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1255.798590] Call Trace: [ 1255.798610] dump_stack+0x188/0x20d [ 1255.798632] should_fail.cold+0xa/0x1b [ 1255.798651] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1255.798670] ? __lock_acquire+0x6ee/0x49c0 [ 1255.798685] ? __lock_acquire+0x6ee/0x49c0 [ 1255.798707] __should_failslab+0x115/0x180 [ 1255.798732] should_failslab+0x5/0xf [ 1255.798747] kmem_cache_alloc_node_trace+0x59/0x750 [ 1255.798774] __kmalloc_node_track_caller+0x38/0x70 [ 1255.798795] __kmalloc_reserve.isra.0+0x39/0xe0 [ 1255.798816] __alloc_skb+0xef/0x5b0 [ 1255.798834] ? skb_trim+0x180/0x180 [ 1255.798860] tipc_buf_acquire+0x28/0x100 [ 1255.798877] named_prepare_buf+0x2d/0x3c0 [ 1255.798892] ? lockdep_hardirqs_on+0x196/0x5d0 [ 1255.798911] tipc_named_withdraw+0x33f/0x7b0 [ 1255.798933] tipc_nametbl_withdraw+0x574/0xa70 [ 1255.798952] tipc_sk_withdraw+0x431/0x550 [ 1255.798973] tipc_sk_leave+0x115/0x190 [ 1255.798988] ? tipc_sk_withdraw+0x550/0x550 [ 1255.799003] ? do_wait_intr_irq+0x270/0x270 [ 1255.799023] ? mark_held_locks+0xa6/0xf0 [ 1255.799040] ? __local_bh_enable_ip+0x159/0x270 [ 1255.799061] tipc_release+0xad/0xfc0 [ 1255.799078] ? __sock_release+0x86/0x2a0 [ 1255.799103] __sock_release+0xcd/0x2a0 [ 1255.799121] ? __sock_release+0x2a0/0x2a0 [ 1255.799135] sock_close+0x15/0x20 [ 1255.799151] __fput+0x2cd/0x890 [ 1255.799173] task_work_run+0x13f/0x1b0 [ 1255.799196] exit_to_usermode_loop+0x25a/0x2b0 [ 1255.799215] do_syscall_64+0x538/0x620 [ 1255.799232] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1255.799243] RIP: 0033:0x45c829 [ 1255.799258] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1255.799266] RSP: 002b:00007f3f13095c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 1255.799280] RAX: 0000000000000003 RBX: 00000000004db200 RCX: 000000000045c829 [ 1255.799288] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 1255.799296] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1255.799305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 1255.799314] R13: 000000000000009d R14: 00000000004c331f R15: 00007f3f130966d4 [ 1255.799385] Withdrawal distribution failure [ 1257.317439] Bluetooth: hci0: command 0x1003 tx timeout [ 1257.322878] Bluetooth: hci0: sending frame failed (-49) [ 1259.397321] Bluetooth: hci0: command 0x1001 tx timeout [ 1259.402758] Bluetooth: hci0: sending frame failed (-49) [ 1261.477184] Bluetooth: hci0: command 0x1009 tx timeout 22:08:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) finit_module(r1, &(0x7f0000000080)='em1\x00', 0x3) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:08:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x204000, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:45 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) 22:08:45 executing program 2 (fault-call:4 fault-nth:2): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:08:45 executing program 0 (fault-call:11 fault-nth:3): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:45 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) 22:08:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1265.887474] Bluetooth: hci0: Frame reassembly failed (-84) [ 1265.899092] binder: 18921:18932 unknown command 287492 [ 1265.910387] binder: 18921:18932 ioctl c0306201 20000200 returned -22 22:08:45 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1265.947213] FAULT_INJECTION: forcing a failure. [ 1265.947213] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1265.952468] binder: 18921:18932 ioctl c0306201 20000280 returned -14 22:08:46 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f79ef291c40b0878ac0799d217523cd2ea062e2589d14d28211df997b28177597b21ab20b7940113cbfa9ce01f1b88bac179ee13a6bf0401a1a882770b9c98d84885d9a9626469b944897c04cab37a5a74ae065cf056840e6a33e7f10bba2f", @ANYRES16, @ANYBLOB="04002bbd7000fbdbdf23cc8bb4000800010000000000f8555d02ccaac39b7dc03c2ff75783d010fc7ae5dbc2cbb2539010a9f04b24595e2cccbf20395ca951a6215c5e8249ea3a8a32a6e6867a63678e889673a1c3c04b0bbad9a7022b72a68e84ea2c514143ac31f4bdbb1e90816af57c91c86f94200a3f5b4c209ed1e76be45cf8c12082a327af5074892c9cbbb8802a2a6b8feefd117546c103b0f68df33921631a8ef7e7edabd1877465def5461faa914c8b9817f37afc95f66fddc9d227a8a2fc78c66449e3a46aa077"], 0x3}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000000)=0x2, 0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000000100)) [ 1266.006238] CPU: 1 PID: 18935 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1266.014159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1266.023521] Call Trace: [ 1266.026123] dump_stack+0x188/0x20d [ 1266.029769] should_fail.cold+0xa/0x1b [ 1266.033677] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1266.038809] __alloc_pages_nodemask+0x1c7/0x6a0 [ 1266.043500] ? lock_acquire+0x170/0x400 [ 1266.047493] ? binder_alloc_new_buf+0x2f/0x1500 [ 1266.052180] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 1266.057250] ? __lock_is_held+0xad/0x140 [ 1266.061339] alloc_pages_current+0xff/0x200 [ 1266.065682] binder_update_page_range+0x2d3/0x1c10 [ 1266.070633] ? fs_reclaim_acquire+0x10/0x10 [ 1266.075075] ? binder_shrink_count+0xb0/0xb0 [ 1266.079514] binder_alloc_new_buf+0xa59/0x1500 [ 1266.084126] binder_transaction+0xea9/0x6ca0 [ 1266.088559] ? mark_held_locks+0xf0/0xf0 [ 1266.092646] ? mark_held_locks+0xf0/0xf0 [ 1266.096769] ? find_held_lock+0x2d/0x110 [ 1266.101060] ? binder_thread_read+0x2d50/0x2d50 22:08:46 executing program 2: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1266.105746] ? lock_downgrade+0x740/0x740 [ 1266.109927] ? __might_fault+0x192/0x1d0 [ 1266.114007] binder_thread_write+0x5d3/0x2a00 [ 1266.119218] ? mark_held_locks+0xf0/0xf0 [ 1266.123289] ? unwind_next_frame+0xd01/0x18a0 [ 1266.127795] ? binder_transaction+0x6ca0/0x6ca0 [ 1266.132479] ? find_held_lock+0x2d/0x110 [ 1266.136554] ? __might_fault+0x11f/0x1d0 [ 1266.140637] ? lock_downgrade+0x740/0x740 [ 1266.144807] ? __might_fault+0x192/0x1d0 [ 1266.148889] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1266.154269] ? binder_thread_write+0x2a00/0x2a00 [ 1266.159035] ? avc_ss_reset+0x180/0x180 [ 1266.163023] ? _raw_spin_unlock+0x29/0x40 [ 1266.167181] ? binder_get_thread+0x17a/0x7c0 [ 1266.171610] binder_ioctl+0x360/0x100f [ 1266.175512] ? mark_held_locks+0xf0/0xf0 [ 1266.179582] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1266.185128] ? proc_fail_nth_write+0x95/0x1d0 [ 1266.189632] ? proc_cwd_link+0x1d0/0x1d0 [ 1266.193722] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1266.199280] do_vfs_ioctl+0xcda/0x12e0 22:08:46 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f00000002c0)=""/4096) dup2(r1, r0) [ 1266.203182] ? selinux_file_ioctl+0x46c/0x5d0 [ 1266.207692] ? selinux_file_ioctl+0x125/0x5d0 [ 1266.212203] ? check_preemption_disabled+0x41/0x280 [ 1266.217257] ? ioctl_preallocate+0x200/0x200 [ 1266.221683] ? selinux_file_mprotect+0x600/0x600 [ 1266.226452] ? __fget+0x340/0x510 [ 1266.229923] ? iterate_fd+0x350/0x350 [ 1266.233743] ? security_file_ioctl+0x6c/0xb0 [ 1266.238166] ksys_ioctl+0x9b/0xc0 [ 1266.241632] __x64_sys_ioctl+0x6f/0xb0 [ 1266.245529] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1266.250123] do_syscall_64+0xf9/0x620 [ 1266.253939] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1266.259137] RIP: 0033:0x45c829 [ 1266.262354] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1266.281264] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1266.288989] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1266.296268] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1266.303546] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1266.312558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1266.320271] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1266.343570] binder_alloc: 18926: binder_alloc_buf failed for page at 000000000340349d [ 1266.352512] binder: 18926:18935 ioctl c0306201 20000280 returned -14 [ 1267.960369] Bluetooth: hci0: command 0x1003 tx timeout [ 1267.965901] Bluetooth: hci0: sending frame failed (-49) [ 1270.036324] Bluetooth: hci0: command 0x1001 tx timeout [ 1270.041698] Bluetooth: hci0: sending frame failed (-49) [ 1272.126095] Bluetooth: hci0: command 0x1009 tx timeout 22:08:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="046304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_G_AUDIO(r1, 0x80345621, &(0x7f0000000000)) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$kcm(0x10, 0x3, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r3, 0x406, r4) getsockopt$sock_buf(r3, 0x1, 0x1c, &(0x7f0000000200)=""/83, &(0x7f00000002c0)=0x53) r5 = socket$tipc(0x1e, 0x5, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETSF(r6, 0x5404, &(0x7f0000000140)={0x36e, 0x0, 0x9a5e, 0x1f, 0x1b, "166b37d5dc029a56395fef8c2e76e4b0756c9f"}) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000000c0)=0x13) fcntl$setpipe(r7, 0x407, 0x40) 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:56 executing program 0 (fault-call:11 fault-nth:4): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) [ 1276.140456] binder: 18978:18985 unknown command 287492 [ 1276.188538] FAULT_INJECTION: forcing a failure. [ 1276.188538] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1276.198137] binder: 18978:18985 ioctl c0306201 20000200 returned -22 [ 1276.209826] binder: 18978:18993 ioctl c0306201 20000280 returned -14 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) [ 1276.264342] CPU: 1 PID: 18991 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1276.272348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1276.281733] Call Trace: [ 1276.284338] dump_stack+0x188/0x20d [ 1276.287994] should_fail.cold+0xa/0x1b [ 1276.291898] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1276.297025] __alloc_pages_nodemask+0x1c7/0x6a0 [ 1276.301708] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 1276.306748] alloc_pages_current+0xff/0x200 [ 1276.311076] pte_alloc_one+0x16/0x190 [ 1276.314884] __pte_alloc+0x25/0x350 [ 1276.318521] __get_locked_pte+0x2df/0x420 [ 1276.322675] vm_insert_page+0x2b0/0x850 [ 1276.326655] ? __get_locked_pte+0x420/0x420 [ 1276.331022] binder_update_page_range+0x3d4/0x1c10 [ 1276.335964] ? binder_shrink_count+0xb0/0xb0 [ 1276.340391] binder_alloc_new_buf+0xa59/0x1500 [ 1276.345019] binder_transaction+0xea9/0x6ca0 [ 1276.349433] ? mark_held_locks+0xf0/0xf0 [ 1276.353501] ? mark_held_locks+0xf0/0xf0 [ 1276.357566] ? find_held_lock+0x2d/0x110 [ 1276.361648] ? binder_thread_read+0x2d50/0x2d50 [ 1276.366328] ? lock_downgrade+0x740/0x740 [ 1276.370504] ? __might_fault+0x192/0x1d0 [ 1276.374608] binder_thread_write+0x5d3/0x2a00 [ 1276.379119] ? mark_held_locks+0xf0/0xf0 [ 1276.383185] ? unwind_next_frame+0xd01/0x18a0 [ 1276.387689] ? binder_transaction+0x6ca0/0x6ca0 [ 1276.392372] ? find_held_lock+0x2d/0x110 [ 1276.396454] ? __might_fault+0x11f/0x1d0 [ 1276.400531] ? lock_downgrade+0x740/0x740 [ 1276.404711] ? __might_fault+0x192/0x1d0 [ 1276.408788] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1276.414165] ? binder_thread_write+0x2a00/0x2a00 [ 1276.418931] ? avc_ss_reset+0x180/0x180 [ 1276.423038] ? _raw_spin_unlock+0x29/0x40 [ 1276.427193] ? binder_get_thread+0x17a/0x7c0 [ 1276.431614] binder_ioctl+0x360/0x100f [ 1276.435515] ? mark_held_locks+0xf0/0xf0 [ 1276.439589] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1276.445130] ? proc_fail_nth_write+0x95/0x1d0 [ 1276.449636] ? proc_cwd_link+0x1d0/0x1d0 [ 1276.453719] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1276.459268] do_vfs_ioctl+0xcda/0x12e0 [ 1276.463169] ? selinux_file_ioctl+0x46c/0x5d0 [ 1276.467674] ? selinux_file_ioctl+0x125/0x5d0 [ 1276.472181] ? check_preemption_disabled+0x41/0x280 [ 1276.477207] ? ioctl_preallocate+0x200/0x200 [ 1276.481631] ? selinux_file_mprotect+0x600/0x600 [ 1276.486400] ? __fget+0x340/0x510 [ 1276.489866] ? iterate_fd+0x350/0x350 [ 1276.493685] ? security_file_ioctl+0x6c/0xb0 [ 1276.498108] ksys_ioctl+0x9b/0xc0 [ 1276.501758] __x64_sys_ioctl+0x6f/0xb0 [ 1276.505673] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1276.510390] do_syscall_64+0xf9/0x620 [ 1276.514218] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1276.519507] RIP: 0033:0x45c829 [ 1276.522704] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1276.541715] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1276.549810] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1276.557439] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 22:08:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x40, 0x1002, 0x2}, 0x10) dup2(r1, r0) [ 1276.564723] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1276.572005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1276.579283] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 22:08:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1276.628826] binder_alloc: 18979: binder_alloc_buf failed to map page at 20ffc000 in userspace [ 1276.637713] binder: 18979:18991 ioctl c0306201 20000280 returned -14 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) [ 1276.712051] binder: 19008:19009 ioctl c0306201 20000280 returned -14 22:08:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1276.855276] binder: 19017:19020 ioctl c0306201 20000280 returned -14 22:08:56 executing program 0 (fault-call:11 fault-nth:5): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r1, 0x406, r2) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) r4 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setregid(r5, 0x0) r6 = getegid() r7 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setregid(r8, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000000c0)={{}, {0x1, 0x2}, [{0x2, 0x7, r3}], {0x4, 0x2}, [{0x8, 0x3, r5}, {0x8, 0x5, r6}, {0x8, 0x6, r8}], {0x10, 0x3}, {0x20, 0x6}}, 0x44, 0x2) r9 = socket$inet(0x2, 0x80000, 0x7754f188) setsockopt$inet_udp_encap(r9, 0x11, 0x64, &(0x7f0000000200)=0x2, 0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r10 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r10, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r10, r0) shutdown(r10, 0x0) 22:08:56 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:57 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:08:57 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) dup2(r1, r0) [ 1277.030051] binder: 19030:19036 ioctl c0306201 20000280 returned -14 [ 1277.063941] FAULT_INJECTION: forcing a failure. [ 1277.063941] name failslab, interval 1, probability 0, space 0, times 0 [ 1277.113126] CPU: 1 PID: 19039 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1277.121063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1277.130429] Call Trace: [ 1277.133036] dump_stack+0x188/0x20d [ 1277.136686] should_fail.cold+0xa/0x1b [ 1277.140591] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1277.145706] ? __lock_is_held+0xad/0x140 [ 1277.149788] __should_failslab+0x115/0x180 [ 1277.154033] should_failslab+0x5/0xf [ 1277.157756] kmem_cache_alloc+0x29f/0x710 [ 1277.157921] binder: 19046:19047 ioctl c0306201 20000280 returned -14 [ 1277.161915] ptlock_alloc+0x1d/0x70 [ 1277.161931] pte_alloc_one+0x68/0x190 [ 1277.161947] __pte_alloc+0x25/0x350 [ 1277.179584] __get_locked_pte+0x2df/0x420 [ 1277.179600] vm_insert_page+0x2b0/0x850 [ 1277.179617] ? __get_locked_pte+0x420/0x420 [ 1277.179644] binder_update_page_range+0x3d4/0x1c10 [ 1277.179667] ? binder_shrink_count+0xb0/0xb0 [ 1277.179692] binder_alloc_new_buf+0xa59/0x1500 [ 1277.179721] binder_transaction+0xea9/0x6ca0 22:08:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) [ 1277.179736] ? mark_held_locks+0xf0/0xf0 [ 1277.179757] ? mark_held_locks+0xf0/0xf0 [ 1277.218682] ? find_held_lock+0x2d/0x110 [ 1277.218713] ? binder_thread_read+0x2d50/0x2d50 [ 1277.218728] ? lock_downgrade+0x740/0x740 22:08:57 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r6, 0x8982, &(0x7f0000000200)) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000000)={0x7f, 0xa, 0x4, 0x10000, 0x2, {}, {0x1, 0x8, 0x3, 0x1f, 0x81, 0x7f, "6e856e55"}, 0x5, 0x3, @fd=r4, 0xfff, 0x0, r0}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r7, 0x4020565b, &(0x7f0000000080)={0x2, 0x4, 0x1}) dup2(r1, r0) [ 1277.218757] ? __might_fault+0x192/0x1d0 [ 1277.218777] binder_thread_write+0x5d3/0x2a00 [ 1277.218807] ? mark_held_locks+0xf0/0xf0 [ 1277.218822] ? unwind_next_frame+0xd01/0x18a0 [ 1277.218835] ? binder_transaction+0x6ca0/0x6ca0 [ 1277.218851] ? find_held_lock+0x2d/0x110 [ 1277.218867] ? __might_fault+0x11f/0x1d0 [ 1277.218887] ? lock_downgrade+0x740/0x740 [ 1277.218912] ? __might_fault+0x192/0x1d0 [ 1277.218932] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1277.218949] ? binder_thread_write+0x2a00/0x2a00 [ 1277.218964] ? avc_ss_reset+0x180/0x180 [ 1277.218983] ? _raw_spin_unlock+0x29/0x40 [ 1277.218996] ? binder_get_thread+0x17a/0x7c0 [ 1277.219015] binder_ioctl+0x360/0x100f [ 1277.219034] ? mark_held_locks+0xf0/0xf0 [ 1277.219050] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1277.219063] ? proc_fail_nth_write+0x95/0x1d0 [ 1277.219077] ? proc_cwd_link+0x1d0/0x1d0 [ 1277.219104] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1277.219122] do_vfs_ioctl+0xcda/0x12e0 [ 1277.219140] ? selinux_file_ioctl+0x46c/0x5d0 [ 1277.219157] ? selinux_file_ioctl+0x125/0x5d0 [ 1277.219175] ? check_preemption_disabled+0x41/0x280 [ 1277.219190] ? ioctl_preallocate+0x200/0x200 [ 1277.219206] ? selinux_file_mprotect+0x600/0x600 [ 1277.219223] ? __fget+0x340/0x510 [ 1277.219242] ? iterate_fd+0x350/0x350 [ 1277.219267] ? security_file_ioctl+0x6c/0xb0 [ 1277.219284] ksys_ioctl+0x9b/0xc0 [ 1277.219301] __x64_sys_ioctl+0x6f/0xb0 [ 1277.219315] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1277.219332] do_syscall_64+0xf9/0x620 [ 1277.219349] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1277.219361] RIP: 0033:0x45c829 [ 1277.219378] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1277.219386] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1277.219401] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1277.219411] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1277.219419] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1277.219428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1277.219438] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1277.326173] binder: 19054:19056 ioctl c0306201 20000280 returned -14 [ 1277.457628] binder_alloc: 19029: binder_alloc_buf failed to map page at 20ffc000 in userspace [ 1277.457698] binder: 19029:19039 ioctl c0306201 20000280 returned -14 22:08:57 executing program 0 (fault-call:11 fault-nth:6): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x4008040, 0x0) dup2(r3, 0xffffffffffffffff) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c80) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r5) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r5) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:08:57 executing program 2: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:08:57 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) [ 1277.839260] binder: 19068:19074 ioctl c0306201 20000280 returned -14 22:08:57 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) 22:08:57 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio1\x00', 0x4000, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) dup2(r3, 0xffffffffffffffff) 22:08:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:08:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1277.884295] Bluetooth: hci0: Frame reassembly failed (-84) [ 1277.954886] FAULT_INJECTION: forcing a failure. [ 1277.954886] name failslab, interval 1, probability 0, space 0, times 0 [ 1277.998697] CPU: 0 PID: 19086 Comm: syz-executor.0 Not tainted 4.19.118-syzkaller #0 [ 1278.006624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1278.015989] Call Trace: [ 1278.018596] dump_stack+0x188/0x20d [ 1278.022247] should_fail.cold+0xa/0x1b [ 1278.026156] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1278.031272] ? __lock_is_held+0xad/0x140 [ 1278.035360] __should_failslab+0x115/0x180 [ 1278.039607] should_failslab+0x5/0xf [ 1278.041031] binder_alloc: 19090: binder_alloc_buf, no vma [ 1278.043350] kmem_cache_alloc_trace+0x2c6/0x7a0 [ 1278.043376] binder_alloc_new_buf+0xac6/0x1500 [ 1278.043400] binder_transaction+0xea9/0x6ca0 [ 1278.054709] binder: 19090:19092 ioctl c0306201 20000280 returned -14 [ 1278.058142] ? mark_held_locks+0xf0/0xf0 [ 1278.058161] ? mark_held_locks+0xf0/0xf0 [ 1278.058176] ? find_held_lock+0x2d/0x110 [ 1278.058207] ? binder_thread_read+0x2d50/0x2d50 [ 1278.058221] ? lock_downgrade+0x740/0x740 [ 1278.058248] ? __might_fault+0x192/0x1d0 [ 1278.058267] binder_thread_write+0x5d3/0x2a00 [ 1278.058288] ? mark_held_locks+0xf0/0xf0 [ 1278.102722] ? unwind_next_frame+0xd01/0x18a0 [ 1278.107237] ? binder_transaction+0x6ca0/0x6ca0 [ 1278.111927] ? find_held_lock+0x2d/0x110 [ 1278.116007] ? __might_fault+0x11f/0x1d0 [ 1278.120088] ? lock_downgrade+0x740/0x740 [ 1278.124267] ? __might_fault+0x192/0x1d0 [ 1278.128352] binder_ioctl_write_read.isra.0+0x20f/0x810 [ 1278.133747] ? binder_thread_write+0x2a00/0x2a00 [ 1278.138522] ? avc_ss_reset+0x180/0x180 [ 1278.144484] ? _raw_spin_unlock+0x29/0x40 22:08:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) [ 1278.148648] ? binder_get_thread+0x17a/0x7c0 [ 1278.153075] binder_ioctl+0x360/0x100f [ 1278.156982] ? mark_held_locks+0xf0/0xf0 [ 1278.161059] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1278.166613] ? proc_fail_nth_write+0x95/0x1d0 [ 1278.171121] ? proc_cwd_link+0x1d0/0x1d0 [ 1278.175235] ? binder_ioctl_write_read.isra.0+0x810/0x810 [ 1278.181041] do_vfs_ioctl+0xcda/0x12e0 [ 1278.184955] ? selinux_file_ioctl+0x46c/0x5d0 [ 1278.189472] ? selinux_file_ioctl+0x125/0x5d0 [ 1278.193986] ? check_preemption_disabled+0x41/0x280 [ 1278.199023] ? ioctl_preallocate+0x200/0x200 [ 1278.203465] ? selinux_file_mprotect+0x600/0x600 [ 1278.208240] ? __fget+0x340/0x510 [ 1278.211919] ? iterate_fd+0x350/0x350 [ 1278.215752] ? security_file_ioctl+0x6c/0xb0 [ 1278.220193] ksys_ioctl+0x9b/0xc0 [ 1278.223669] __x64_sys_ioctl+0x6f/0xb0 [ 1278.227569] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1278.232168] do_syscall_64+0xf9/0x620 [ 1278.236010] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1278.241219] RIP: 0033:0x45c829 22:08:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) [ 1278.244423] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1278.263925] RSP: 002b:00007f1d42951c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1278.271845] RAX: ffffffffffffffda RBX: 00000000004e0fc0 RCX: 000000000045c829 [ 1278.279129] RDX: 0000000020000280 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1278.286410] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1278.293688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 1278.300969] R13: 0000000000000214 R14: 00000000004c438f R15: 00007f1d429526d4 [ 1278.391061] binder_alloc: binder_alloc_new_buf_locked: 19075 failed to alloc new buffer struct [ 1278.408859] binder: 19075:19086 ioctl c0306201 20000280 returned -14 22:08:58 executing program 0 (fault-call:11 fault-nth:7): r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:08:58 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) [ 1278.722277] binder_alloc: 19114: binder_alloc_buf, no vma [ 1278.729027] binder: 19114:19116 ioctl c0306201 20000280 returned -14 [ 1278.747848] binder: 19118:19125 ioctl c0306201 20000280 returned -14 [ 1279.955557] Bluetooth: hci0: command 0x1003 tx timeout [ 1279.960977] Bluetooth: hci0: sending frame failed (-49) [ 1282.035418] Bluetooth: hci0: command 0x1001 tx timeout [ 1282.040842] Bluetooth: hci0: sending frame failed (-49) [ 1284.115120] Bluetooth: hci0: command 0x1009 tx timeout 22:09:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x40000040, 0x0, 0x2}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:09:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:09:08 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, 0x0) 22:09:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x0, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, 0x0) [ 1288.366170] binder: 19138:19152 ioctl c0306201 20000280 returned -14 [ 1288.373033] binder_alloc: 19136: binder_alloc_buf, no vma [ 1288.391359] binder: 19136:19151 ioctl c0306201 20000280 returned -14 22:09:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:09:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, 0x0) 22:09:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x0, 0x80) ioctl$KDADDIO(r1, 0x400455c8, 0x1000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000100)={0x3, 0x59f6, 0x1, 0xd7, 0x81, 0xe29}) [ 1288.546808] binder_alloc: 19159: binder_alloc_buf, no vma [ 1288.552565] binder: 19159:19165 ioctl c0306201 20000280 returned -14 22:09:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:09:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x1b) 22:09:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = socket$kcm(0x10, 0x3, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r3, 0x406, r4) ioctl$sock_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000000)) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x40080041}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) 22:09:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x2) 22:09:08 executing program 4 (fault-call:3 fault-nth:0): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:09:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) [ 1288.756811] binder_alloc: 19180: binder_alloc_buf, no vma [ 1288.762526] binder: 19180:19185 ioctl c0306201 20000280 returned -14 22:09:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000240)=0x9) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000000)={0x80, 0x8, 0x2, 0x4}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r4, r3) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000200)) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r6, 0x4, 0x70bd2e, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) bind$vsock_dgram(r5, &(0x7f0000000140)={0x28, 0x0, 0x0, @local}, 0x10) 22:09:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x800000f) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x9) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1288.889554] Bluetooth: hci0: Frame reassembly failed (-84) [ 1288.950296] binder_alloc: 19201: binder_alloc_buf, no vma [ 1288.966877] binder: 19201:19212 ioctl c0306201 20000280 returned -14 22:09:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x10, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:09 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:09:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000003c0)={0x1f, 0x3, 0x6, 0x8, 0xc5, 0x40, &(0x7f00000002c0)="b135fb353e052960e0530fccd5c0cc81768aa4af1b4d15dd2ca0aa1f90fcb988890056040154c523f808afc010cd81f95ca1f1dd0b7027431122de8310173e95a1ceff7489ad799f58639ecba90a03da07051a16e6440e1068dd8bf4d15ec8f861a985fd1c7cfcd7004c081bc86c0b92cec0e179b07576623506a510dd6d9adc06da464062a440b2bb924e2ed72926c3e7b3d4831c51a3f0fdc9141b60ff7f4fb2850689a274f4ad62eeb3b821ad90114f21ff232d43e24e94cfcac65a91b64698ebd9011f"}) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x0, 0x4002) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r5, 0xc05c5340, &(0x7f0000000200)={0x5, 0x0, 0x3, {0x9, 0xffffffff}, 0x0, 0x1}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e24, @multicast2}, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="217e3074112aec14597eb2a72c6d46fe75b25e7242a81d4de606089340fc2ba43b71af1b2f9ffc749818443f669fdd2d1ee880ddf5936a35077b8809616e072af59197637793485d7425d84ece5368c1f1869b8024c0efc8b37fc599da4cdba34a3feeb6795cebedc26b30f2480b0259dc6ef36d4cbbdb3f40c0df1d030d4a630b0d0b45872bca0075ed80b4b3ee622399c5cf7376a3a26d0fa75506323d45b2eaa83172474c781502b2b053555db27707bd95", @ANYRES16=r6, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f0000000100), 0x0, 0x1ff) bind$vsock_dgram(r4, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @host}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r3, r0) 22:09:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:09 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x24d00, 0x0) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x19bb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r2 = syz_open_dev$vcsu(&(0x7f0000000100)='/dev/vcsu#\x00', 0x1, 0x301480) ioctl$KDSKBLED(r2, 0x4b65, 0x6) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCEXCL(r3, 0x540c) 22:09:09 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x2, &(0x7f00000000c0)=0x13) [ 1289.383159] binder_alloc: 19224: binder_alloc_buf, no vma [ 1289.397123] sp0: Synchronizing with TNC [ 1289.409378] binder: 19224:19229 ioctl c0306201 20000280 returned -14 22:09:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f0000000040)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xfffffffffffffd3f, &(0x7f0000000180)={&(0x7f0000000200)={0x14, r3, 0x400, 0x70bd2c, 0x25dfdbdb, {}, [@NL80211_ATTR_WDEV={0x0, 0x99, {0x0, 0x1}}, @NL80211_ATTR_IFINDEX={0x0, 0x3, r8}, @NL80211_ATTR_WDEV={0x0, 0x99, {0x1ff, 0xffffffffffffffff}}, @NL80211_ATTR_MESH_CONFIG, @NL80211_ATTR_MESH_CONFIG={0x0, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_TTL={0x0, 0x6, 0x6}, @NL80211_MESHCONF_ELEMENT_TTL, @NL80211_MESHCONF_AWAKE_WINDOW={0x0, 0x1b, 0xfe16}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x0, 0x11, 0x1}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x48c8}, 0x91) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f0000000000)={0x2}) 22:09:09 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x4b47, &(0x7f00000000c0)=0x13) [ 1289.452469] binder: 19226:19241 ioctl 10 20000280 returned -22 [ 1289.506355] sp0: Synchronizing with TNC [ 1290.914521] Bluetooth: hci0: command 0x1003 tx timeout [ 1290.919921] Bluetooth: hci0: sending frame failed (-49) [ 1292.994303] Bluetooth: hci0: command 0x1001 tx timeout [ 1292.999867] Bluetooth: hci0: sending frame failed (-49) [ 1295.074065] Bluetooth: hci0: command 0x1009 tx timeout 22:09:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) 22:09:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:09:19 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x5) dup2(r1, r0) 22:09:19 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x4b49, &(0x7f00000000c0)=0x13) 22:09:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:19 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5409, &(0x7f00000000c0)=0x13) [ 1299.149900] binder_alloc: 19295: binder_alloc_buf, no vma [ 1299.170162] binder: 19295:19301 ioctl c0306201 20000280 returned -14 [ 1299.185702] Bluetooth: hci0: sending frame failed (-49) 22:09:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0xa3828712ce991a4a, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x11) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TCGETX(r1, 0x5432, &(0x7f0000000080)) 22:09:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1299.229721] binder: 19299:19315 ioctl 4b47 20000280 returned -22 22:09:19 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x540b, &(0x7f00000000c0)=0x13) 22:09:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x0, 0xfffffffffffffffe) ioctl$VIDIOC_G_ENC_INDEX(r3, 0x8818564c, &(0x7f0000000100)) [ 1299.347148] binder_alloc: 19320: binder_alloc_buf, no vma [ 1299.371125] binder: 19320:19324 ioctl c0306201 20000280 returned -14 22:09:19 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x540c, &(0x7f00000000c0)=0x13) [ 1299.492129] Bluetooth: hci1: Frame reassembly failed (-90) [ 1301.233559] Bluetooth: hci0: command 0x1003 tx timeout [ 1301.239047] Bluetooth: hci0: sending frame failed (-49) [ 1301.553525] Bluetooth: hci1: command 0x1003 tx timeout [ 1301.558918] Bluetooth: hci1: sending frame failed (-49) [ 1303.313418] Bluetooth: hci0: command 0x1001 tx timeout [ 1303.318980] Bluetooth: hci0: sending frame failed (-49) [ 1303.633431] Bluetooth: hci1: command 0x1001 tx timeout [ 1303.640163] Bluetooth: hci1: sending frame failed (-49) [ 1305.393267] Bluetooth: hci0: command 0x1009 tx timeout [ 1305.713251] Bluetooth: hci1: command 0x1009 tx timeout 22:09:29 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = dup2(r1, r0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0356000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r3, @ANYBLOB="7fe3a5f01000c695c48cca1e172b67703c7cd652ef03cf803874d1b8cd24d37a"], 0x3c}}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r4, 0x406, r5) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000007f80)={'vcan0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x3c}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r12}]}, 0x3c}}, 0x0) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f00000086c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000008680)={&(0x7f0000007fc0)={0x690, 0x0, 0x20, 0x70bd27, 0x25dfdbff, {}, [{{0x8}, {0xb8, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x80000000}}, {0x8}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x318b}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x1d4, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0xb0fc0000}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8, 0x1, r3}, {0x21c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r12}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0xff}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x7f}}}]}}]}, 0x690}, 0x1, 0x0, 0x0, 0x24008004}, 0x800) 22:09:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4b49, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:29 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x540d, &(0x7f00000000c0)=0x13) 22:09:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:29 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) 22:09:29 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5413, &(0x7f00000000c0)=0x13) [ 1309.382510] binder_alloc: 19353: binder_alloc_buf, no vma [ 1309.399691] binder: 19353:19357 ioctl c0306201 20000280 returned -14 [ 1309.422319] Bluetooth: hci0: Frame reassembly failed (-84) 22:09:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:29 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000000)={0x0, 0xe, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r4, &(0x7f0000000140)={0xc, 0x8, 0xfa00, {0x0}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r5}}, 0x48) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f0000000000)={0x6, 0x118, 0xfa00, {{0x9, 0x7, "121fc8b27cba5c65d84963628920d57415a7eaf941ef34d233027765739d36eaff541d55ca509730b0a7ca0b760940a1904dad8ecbfb5c7bf4037d05bfa0b12637a342c182f54b121dd5c07bfcb592100a7313271db7f87bb812f6c733ab7135c4d5647455a84923e9bbaab2a0ffa6a8c6216ebc6070bcb805b82f03626749c00ceaa3ec78a48b86706dae877183aa099d5488ef14b98cc49bc1c369239494dc39b25e513b95253186ce61953034c263f4429056c459782d7ea4461db51b74ac5928061579e0d53971bb9eee3f1bb0eac2579a2128a41c3b56cdae3359e5e880863615e880cdc6a29399808f8ba0fdfb6780d752890de579764d8ee3898cd85a", 0x0, 0x7d, 0x8, 0x3, 0x7, 0xff, 0x7, 0x1}, r5}}, 0x120) [ 1309.456801] binder: 19355:19369 ioctl 4b49 20000280 returned -22 22:09:29 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5414, &(0x7f00000000c0)=0x13) [ 1309.516779] binder_alloc: 19373: binder_alloc_buf, no vma [ 1309.522511] binder: 19373:19374 ioctl c0306201 20000280 returned -14 22:09:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1309.606180] binder_alloc: 19383: binder_alloc_buf, no vma [ 1309.612355] binder: 19383:19385 ioctl c0306201 20000280 returned -14 22:09:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:09:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:29 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5415, &(0x7f00000000c0)=0x13) [ 1309.990037] binder_alloc: 19396: binder_alloc_buf, no vma [ 1309.999560] binder: 19396:19397 ioctl c0306201 20000280 returned -14 [ 1310.045321] Bluetooth: hci1: Frame reassembly failed (-84) [ 1311.482779] Bluetooth: hci0: command 0x1003 tx timeout [ 1311.488179] Bluetooth: hci0: sending frame failed (-49) [ 1312.112642] Bluetooth: hci1: command 0x1003 tx timeout [ 1312.118039] Bluetooth: hci1: sending frame failed (-49) [ 1313.552532] Bluetooth: hci0: command 0x1001 tx timeout [ 1313.558102] Bluetooth: hci0: sending frame failed (-49) [ 1314.192530] Bluetooth: hci1: command 0x1001 tx timeout [ 1314.197927] Bluetooth: hci1: sending frame failed (-49) [ 1315.632397] Bluetooth: hci0: command 0x1009 tx timeout [ 1316.272434] Bluetooth: hci1: command 0x1009 tx timeout 22:09:39 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, 0x0) 22:09:39 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200800, 0x0) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000040)) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:09:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:39 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5416, &(0x7f00000000c0)=0x13) 22:09:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x541b, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:39 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5418, &(0x7f00000000c0)=0x13) 22:09:39 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x42, 0x1, 0x3}, 0x10) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r2, r3, 0x3}, 0x10) dup2(r1, r0) [ 1319.622401] binder_alloc: 19417: binder_alloc_buf, no vma [ 1319.642969] binder: 19417:19424 ioctl c0306201 20000280 returned -14 22:09:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1319.687035] binder: 19420:19435 ioctl 541b 20000280 returned -22 22:09:39 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x541b, &(0x7f00000000c0)=0x13) [ 1319.761380] binder_alloc: 19442: binder_alloc_buf, no vma [ 1319.769644] binder: 19442:19443 ioctl c0306201 20000280 returned -14 22:09:40 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) openat$cgroup(r1, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:09:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:40 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x541d, &(0x7f00000000c0)=0x13) [ 1320.227449] binder: 19457:19459 ioctl c0306201 20000280 returned -14 [ 1320.289484] Bluetooth: hci1: Frame reassembly failed (-84) [ 1321.711778] Bluetooth: hci0: command 0x1003 tx timeout [ 1321.717177] Bluetooth: hci0: sending frame failed (-49) [ 1322.351811] Bluetooth: hci1: command 0x1003 tx timeout [ 1322.357211] Bluetooth: hci1: sending frame failed (-49) [ 1323.791744] Bluetooth: hci0: command 0x1001 tx timeout [ 1323.797143] Bluetooth: hci0: sending frame failed (-49) [ 1324.431662] Bluetooth: hci1: command 0x1001 tx timeout [ 1324.437136] Bluetooth: hci1: sending frame failed (-49) [ 1325.871554] Bluetooth: hci0: command 0x1009 tx timeout [ 1326.511417] Bluetooth: hci1: command 0x1009 tx timeout 22:09:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, 0x0) 22:09:49 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$inet(0x2, 0x4000000805, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = dup3(r1, r2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000100), 0x0) sendto$inet(r3, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r2, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x6c, &(0x7f000059aff8)={r4}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000000)={r4, @in={{0x2, 0x4e24, @remote}}, 0x4, 0x7}, &(0x7f00000000c0)=0x90) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) 22:09:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:49 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x541e, &(0x7f00000000c0)=0x13) 22:09:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1329.856005] binder: 19480:19485 ioctl c0306201 20000280 returned -14 22:09:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$inet6(0xa, 0x3, 0x80000000000004) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:49 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5421, &(0x7f00000000c0)=0x13) 22:09:49 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x4000003c, 0xfffffffd}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) prctl$PR_GET_KEEPCAPS(0x7) dup2(r3, r0) [ 1329.995244] binder: 19497:19499 ioctl c0306201 20000280 returned -14 22:09:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:09:50 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080), &(0x7f0000000100)=0x4) 22:09:50 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5423, &(0x7f00000000c0)=0x13) 22:09:50 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20000, 0x0) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x9, 0x7f, 0x0, 0x2, 0x9, 0x4, 0x5}, 0x1c) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) r3 = syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_SUBDEV_G_SELECTION(r3, 0xc040563d, &(0x7f00000000c0)={0x1, 0x0, 0x100, 0x1, {0x1, 0x400, 0x3ff, 0x2}}) [ 1331.871047] Bluetooth: hci0: command 0x1003 tx timeout [ 1331.876423] Bluetooth: hci0: sending frame failed (-49) [ 1332.590913] Bluetooth: hci1: command 0x1003 tx timeout [ 1332.596406] Bluetooth: hci1: sending frame failed (-49) [ 1333.950848] Bluetooth: hci0: command 0x1001 tx timeout [ 1333.956258] Bluetooth: hci0: sending frame failed (-49) [ 1334.670807] Bluetooth: hci1: command 0x1001 tx timeout [ 1334.676203] Bluetooth: hci1: sending frame failed (-49) [ 1336.030720] Bluetooth: hci0: command 0x1009 tx timeout [ 1336.750575] Bluetooth: hci1: command 0x1009 tx timeout 22:10:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x600000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x10000, 0x1, 0x8776d57bb514585d, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r3 = dup2(r1, r0) ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f0000000040)=0x2) 22:10:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:00 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5424, &(0x7f00000000c0)=0x13) 22:10:00 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5437, 0x0) 22:10:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000040)=0x553b) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) ioctl$TIOCNXCL(r4, 0x540d) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x1014c0, 0x0) r7 = dup2(r6, r0) ioctl$KDGKBENT(r7, 0x4b46, &(0x7f0000000000)={0x70, 0x81, 0x1000}) 22:10:00 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5425, &(0x7f00000000c0)=0x13) [ 1340.144603] Bluetooth: hci0: Frame reassembly failed (-84) 22:10:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1340.293539] binder: 19567:19568 ioctl c0306201 0 returned -14 22:10:00 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x5) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:10:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) dup2(r1, r2) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) accept4$llc(r3, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x800) 22:10:00 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5427, &(0x7f00000000c0)=0x13) [ 1340.757694] Bluetooth: hci1: Frame reassembly failed (-84) 22:10:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:10:00 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5428, &(0x7f00000000c0)=0x13) 22:10:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r2, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x4, &(0x7f0000000140)={0x0, 0x39, 0x1, @tid=r2}, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$sock_netrom_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000002c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={'rose', 0x0}, 0x7, 'syz1\x00', @bcast, 0x9, 0x8, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) [ 1340.947521] binder: 19593:19596 ioctl c0306201 0 returned -14 [ 1342.190079] Bluetooth: hci0: command 0x1003 tx timeout [ 1342.195501] Bluetooth: hci0: sending frame failed (-49) [ 1342.840133] Bluetooth: hci1: command 0x1003 tx timeout [ 1342.845541] Bluetooth: hci1: sending frame failed (-49) [ 1344.269956] Bluetooth: hci0: command 0x1001 tx timeout [ 1344.275361] Bluetooth: hci0: sending frame failed (-49) [ 1344.909964] Bluetooth: hci1: command 0x1001 tx timeout [ 1344.917596] Bluetooth: hci1: sending frame failed (-49) [ 1346.349820] Bluetooth: hci0: command 0x1009 tx timeout [ 1346.989713] Bluetooth: hci1: command 0x1009 tx timeout 22:10:10 executing program 5: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r2, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x4, &(0x7f0000000140)={0x0, 0x39, 0x1, @tid=r2}, &(0x7f0000000200)) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$sock_netrom_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000002c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={'rose', 0x0}, 0x7, 'syz1\x00', @bcast, 0x9, 0x8, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) 22:10:10 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5437, &(0x7f00000000c0)=0x13) 22:10:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 22:10:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r2, 0xc040563e, &(0x7f0000000000)={0x2, 0x0, 0x2, 0x4, {0x2, 0x6, 0x108, 0x7464}}) dup2(r1, r0) 22:10:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1350.355130] binder: 19620:19627 ioctl c0306201 0 returned -14 22:10:10 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) listxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/226, 0xe2) ioctl$KDADDIO(r1, 0x400455c8, 0xffffffffffffffff) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:10:10 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5441, &(0x7f00000000c0)=0x13) 22:10:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x43, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x6) dup2(r1, r0) 22:10:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:10:10 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080), &(0x7f0000000100)=0x4) 22:10:10 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5450, &(0x7f00000000c0)=0x13) 22:10:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140)={0x42}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000000)=@gcm_256={{0x303}, "c331a08764b92e8f", "463ccba6d5cbbe3fa94ab797db25c374c5e8d9262bbfbefaa33538cfe4e4e3a5", "7b00b0fb", "2f6d7f421138c439"}, 0x38) dup2(r1, r0) 22:10:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:10:11 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xae8) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000080)=0x2) 22:10:11 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5451, &(0x7f00000000c0)=0x13) 22:10:11 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 22:10:11 executing program 2: r0 = socket$tipc(0x1e, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x64, 0x4, 0x8, 0x301, 0x0, 0x0, {0xa7f06918a01d1d7f}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x60f1}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x10000}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x2c}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x2}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x41}, 0x4000004) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="986c1345385692442750de8eae371b4155d7c0ff1a5c6774f9acae3733ef380df473b5a2", @ANYRES16=r4, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) 22:10:11 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5452, &(0x7f00000000c0)=0x13) 22:10:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xe, 0x80000) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:10:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) [ 1352.989273] Bluetooth: hci0: command 0x1003 tx timeout [ 1352.995367] Bluetooth: hci0: sending frame failed (-49) [ 1355.069068] Bluetooth: hci0: command 0x1001 tx timeout [ 1355.074463] Bluetooth: hci0: sending frame failed (-49) [ 1357.149011] Bluetooth: hci0: command 0x1009 tx timeout 22:10:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080), &(0x7f0000000100)=0x4) 22:10:21 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x545d, &(0x7f00000000c0)=0x13) 22:10:21 executing program 2: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:10:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 22:10:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000000)={0xfffc, 0x0, 0x6}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000140)=0x1b) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000", @ANYRES16=r5, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000200)={r6, 0x5, 0x5}, 0x8) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) getsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, &(0x7f0000000080)=0x3, &(0x7f0000000100)=0x2) 22:10:21 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:21 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5460, &(0x7f00000000c0)=0x13) 22:10:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) [ 1361.258242] Bluetooth: hci0: Frame reassembly failed (-84) [ 1361.270933] Bluetooth: hci0: Frame reassembly failed (-84) 22:10:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='net/udp6\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) write$input_event(r2, &(0x7f0000000000)={{}, 0x3, 0x5, 0x7}, 0x18) dup2(r1, r0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$SIOCAX25GETINFOOLD(r4, 0x89e9, &(0x7f0000000140)) 22:10:21 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x40049409, &(0x7f00000000c0)=0x13) 22:10:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:10:21 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x40086602, &(0x7f00000000c0)=0x13) [ 1363.318367] Bluetooth: hci1: command 0x1003 tx timeout [ 1363.323772] Bluetooth: hci1: sending frame failed (-49) [ 1363.329230] Bluetooth: hci0: command 0x1003 tx timeout [ 1363.334650] Bluetooth: hci0: sending frame failed (-49) [ 1365.388270] Bluetooth: hci0: command 0x1001 tx timeout [ 1365.388276] Bluetooth: hci1: command 0x1001 tx timeout [ 1365.399052] Bluetooth: hci1: sending frame failed (-49) [ 1365.404683] Bluetooth: hci0: sending frame failed (-49) [ 1367.468077] Bluetooth: hci1: command 0x1009 tx timeout [ 1367.468113] Bluetooth: hci0: command 0x1009 tx timeout 22:10:31 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080), &(0x7f0000000100)=0x4) 22:10:31 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000200), &(0x7f0000000240)=0x4) dup2(r1, r0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'os2.', 'proc\x00'}, &(0x7f0000000080)=""/9, 0x9) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r4, 0x80386433, &(0x7f00000000c0)=""/241) 22:10:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:10:31 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x40087602, &(0x7f00000000c0)=0x13) 22:10:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 22:10:31 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x4020940d, &(0x7f00000000c0)=0x13) [ 1371.558457] binder: BINDER_SET_CONTEXT_MGR already set 22:10:31 executing program 2: socket$tipc(0x1e, 0x2, 0x0) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) accept$netrom(r1, &(0x7f0000000000)={{0x3, @default}, [@null, @default, @remote, @netrom, @bcast, @default, @bcast, @default]}, &(0x7f0000000100)=0x48) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x100, 0x0) dup2(r2, r3) [ 1371.581886] binder: 19773:19783 ioctl 40046207 20000280 returned -16 22:10:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:10:31 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x80045432, &(0x7f00000000c0)=0x13) 22:10:31 executing program 1: r0 = semget$private(0x0, 0x4000000009, 0x0) semop(r0, &(0x7f0000000380)=[{0x0, 0x0, 0x1000}], 0x9b) semctl$SETVAL(r0, 0x2, 0x10, &(0x7f0000000100)=0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000140)=0x8, 0x4) ioctl$KDADDIO(r1, 0x400455c8, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x80000, 0x0) ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000000)=0x2) 22:10:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) [ 1371.818129] Bluetooth: hci1: Frame reassembly failed (-84) [ 1373.557524] Bluetooth: hci0: command 0x1003 tx timeout [ 1373.562934] Bluetooth: hci0: sending frame failed (-49) [ 1373.867565] Bluetooth: hci1: command 0x1003 tx timeout [ 1373.872969] Bluetooth: hci1: sending frame failed (-49) [ 1375.627617] Bluetooth: hci0: command 0x1001 tx timeout [ 1375.633023] Bluetooth: hci0: sending frame failed (-49) [ 1375.947388] Bluetooth: hci1: command 0x1001 tx timeout [ 1375.952776] Bluetooth: hci1: sending frame failed (-49) [ 1377.707336] Bluetooth: hci0: command 0x1009 tx timeout [ 1378.027205] Bluetooth: hci1: command 0x1009 tx timeout 22:10:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 22:10:41 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x80045440, &(0x7f00000000c0)=0x13) 22:10:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x7, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000"], 0x0, 0x0, 0x0}) 22:10:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:41 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r6, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000000)={r7, 0x9f}, &(0x7f0000000040)=0x8) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x43, 0x7ffffc, 0x2}, 0x10) dup2(r1, r0) 22:10:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:10:41 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x80086601, &(0x7f00000000c0)=0x13) [ 1381.845937] binder: 19841:19844 unknown command 25344 22:10:41 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x80087601, &(0x7f00000000c0)=0x13) 22:10:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) [ 1381.878285] binder: 19841:19844 ioctl c0306201 20000280 returned -22 22:10:41 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r2, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r2, r2, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r2, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r3, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(r3, &(0x7f0000000500)='personality\x00') ioctl$BLKALIGNOFF(r4, 0x127a, &(0x7f0000000540)) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x800, 0x6, &(0x7f0000000440)=[{&(0x7f0000000080)="9c4abfae7b11ba175eec056ebb62a8d0181c63dbe18c029788bdd58039dffb14f0a62e07acf2fc8f970d3e45035d437e24ce1535aa2add90172bdbd17f9ea3d9e9eb506790d027b910aec99ccbb47ce5641bc5ebf1de82643d655c4c8a4bc06677cab429910b0318011db5a89f4daa2b96c35dd8eb7f547254cd3f6a8319753be03a19178b683db0132474894ddb1e232db9c53f4790b22492d2bf3c72989582516706d6eaf2dd70439108c930", 0xad, 0x100000000}, {&(0x7f0000000140)="5d4e454031a92ca7641f5c8478cdc08b3ae53515cbd596991edd4001b8dd4e89bc35013aa17c1c0a590e806642c62070d9b056b8c5e4b540b0a3970ae20e379d99318197e4404bd7ee0d03683f5eef9737a42ae21bb813266ce8290a64284c8be37ec54433c460aa77e4a3b131daffb2ff09af77fabbfed21e0e61a951bf23e7cfe0c17f2c11d2f69106e0c6e73945b69b7183bd18eb9f1f42657a409823d9524cd1e6453c2de0808277335c06537772e1be4498dacb80aab6ae9a252f1e00aca60beacea4ba768b0c77dc444eb94778942c140e20e1bb", 0xd7, 0x6}, {&(0x7f0000000240)="0eec91db75", 0x5, 0x6}, {&(0x7f00000002c0)="96e2bc89d88feaac59bb33395a370359888e3af1ff8b43c23ffe40e09dfa8ce268bb5d0b195e0b4389babde52c61cf0ee994a78a0323209c00a97f7f0f7ab6ca0ec2ef795a7fa6e703d400704b831f56b08cefaa3a7515e255bef14892", 0x5d, 0x18}, {&(0x7f0000000340)="5683e661561b8cd42f5556e3cb27ee4f4b701e99c1c22d", 0x17, 0x1f}, {&(0x7f0000000380)="8b5cb96251a1690a4e25788a4ba0122bda4c187b173cb4a9d11ee6fd9bba757afc34c667bd7806e1286764fa245d7cee97fc2b2ae802c9c3ccdeaf3aee14359369aabeecb3f78f89519b939638e7df7a0a697c191914aa7bbfa655c82cdb11fd3c3d182914a818ba093046f27af8e42408ac57f0e0a0805fdb143ef953f5d635a6a2893f387ea7254fe7795bceae675af32711b508bd841b9e7a233db8ccfd02a345e0f4", 0xa4, 0x400}], 0x2100c01, 0x0) dup2(r1, r0) [ 1382.002008] binder: 19856:19859 unknown command 25344 [ 1382.010636] binder: 19856:19859 ioctl c0306201 20000280 returned -22 22:10:42 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r3, 0x8982, &(0x7f0000000240)={0x8, 'ip6tnl0\x00', {'gretap0\x00'}, 0x81}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000100)={0xc0ff, 0xa, 0x4, 0x80000000, 0x0, {r4, r5/1000+10000}, {0x3, 0xc, 0x9, 0x3, 0x7f, 0x4, "25132352"}, 0x20, 0x3, @userptr=0x3, 0x6, 0x0, 0xffffffffffffffff}) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000200)=0x10) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000002c0)={0x18, 0x0, {0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'team0\x00'}}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r8, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r7, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r7, 0xc0045004, &(0x7f0000000280)) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:10:42 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0xc0045878, &(0x7f00000000c0)=0x13) [ 1383.716827] Bluetooth: hci0: command 0x1003 tx timeout [ 1383.722244] Bluetooth: hci0: sending frame failed (-49) [ 1385.786808] Bluetooth: hci0: command 0x1001 tx timeout [ 1385.792270] Bluetooth: hci0: sending frame failed (-49) [ 1387.866616] Bluetooth: hci0: command 0x1009 tx timeout 22:10:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:10:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xa, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063"], 0x0, 0x0, 0x0}) 22:10:51 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:10:51 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0xc0045878, &(0x7f00000000c0)=0x13) 22:10:51 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) connect$tipc(r1, &(0x7f0000000080)=@id={0x1e, 0x3, 0x2, {0x4e20, 0x1}}, 0x10) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:10:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:10:51 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0xc0189436, &(0x7f00000000c0)=0x13) [ 1391.950251] binder: 19898:19907 unknown command 25344 [ 1391.979358] binder: 19898:19907 ioctl c0306201 20000280 returned -22 [ 1391.988006] Bluetooth: hci0: Frame reassembly failed (-90) 22:10:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x40}, 0x10) dup2(r1, r0) 22:10:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:10:52 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0xc020660b, &(0x7f00000000c0)=0x13) 22:10:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="040029bd7000fbdbdf251d0000000800921579072140010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e21, @remote}], 0x20) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000000)) dup2(r1, r0) 22:10:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) [ 1394.025911] Bluetooth: hci1: command 0x1003 tx timeout [ 1394.031298] Bluetooth: hci1: sending frame failed (-49) [ 1394.037709] Bluetooth: hci0: command 0x1003 tx timeout [ 1394.043059] Bluetooth: hci0: sending frame failed (-49) [ 1396.105873] Bluetooth: hci1: command 0x1001 tx timeout [ 1396.111272] Bluetooth: hci1: sending frame failed (-49) [ 1396.116756] Bluetooth: hci0: command 0x1001 tx timeout [ 1396.122115] Bluetooth: hci0: sending frame failed (-49) [ 1398.185636] Bluetooth: hci1: command 0x1009 tx timeout [ 1398.185663] Bluetooth: hci0: command 0x1009 tx timeout 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:11:02 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x11) 22:11:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400000000000634040"], 0x0, 0x0, 0x0}) 22:11:02 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40086602, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = open(&(0x7f0000000000)='./file0\x00', 0x210000, 0x20) ioctl$NS_GET_USERNS(r1, 0xb701, 0x0) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x10, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x18}}, 0x800) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0x0, 0xb, 0x0, &(0x7f00000000c0)="61df712bc884fed5722780", 0x0, 0x8000}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={r1, 0xc0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001700)=0x1, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x3}, 0x0, 0x0, &(0x7f0000000440)={0xfffffffe, 0x0, 0xfffffffb, 0x7}, &(0x7f0000000480)=0x1000020, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000003b00)={0xffffffffffffffff, 0x10, &(0x7f0000003ac0)={&(0x7f0000003a40)=""/90, 0x5a, r2}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=r2, 0x4) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1402.258634] binder: 19957:19966 ioctl 40086602 20000280 returned -22 22:11:02 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r2, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r2, r2, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r2, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r3, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(r3, &(0x7f0000000500)='personality\x00') ioctl$BLKALIGNOFF(r4, 0x127a, &(0x7f0000000540)) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x800, 0x6, &(0x7f0000000440)=[{&(0x7f0000000080)="9c4abfae7b11ba175eec056ebb62a8d0181c63dbe18c029788bdd58039dffb14f0a62e07acf2fc8f970d3e45035d437e24ce1535aa2add90172bdbd17f9ea3d9e9eb506790d027b910aec99ccbb47ce5641bc5ebf1de82643d655c4c8a4bc06677cab429910b0318011db5a89f4daa2b96c35dd8eb7f547254cd3f6a8319753be03a19178b683db0132474894ddb1e232db9c53f4790b22492d2bf3c72989582516706d6eaf2dd70439108c930", 0xad, 0x100000000}, {&(0x7f0000000140)="5d4e454031a92ca7641f5c8478cdc08b3ae53515cbd596991edd4001b8dd4e89bc35013aa17c1c0a590e806642c62070d9b056b8c5e4b540b0a3970ae20e379d99318197e4404bd7ee0d03683f5eef9737a42ae21bb813266ce8290a64284c8be37ec54433c460aa77e4a3b131daffb2ff09af77fabbfed21e0e61a951bf23e7cfe0c17f2c11d2f69106e0c6e73945b69b7183bd18eb9f1f42657a409823d9524cd1e6453c2de0808277335c06537772e1be4498dacb80aab6ae9a252f1e00aca60beacea4ba768b0c77dc444eb94778942c140e20e1bb", 0xd7, 0x6}, {&(0x7f0000000240)="0eec91db75", 0x5, 0x6}, {&(0x7f00000002c0)="96e2bc89d88feaac59bb33395a370359888e3af1ff8b43c23ffe40e09dfa8ce268bb5d0b195e0b4389babde52c61cf0ee994a78a0323209c00a97f7f0f7ab6ca0ec2ef795a7fa6e703d400704b831f56b08cefaa3a7515e255bef14892", 0x5d, 0x18}, {&(0x7f0000000340)="5683e661561b8cd42f5556e3cb27ee4f4b701e99c1c22d", 0x17, 0x1f}, {&(0x7f0000000380)="8b5cb96251a1690a4e25788a4ba0122bda4c187b173cb4a9d11ee6fd9bba757afc34c667bd7806e1286764fa245d7cee97fc2b2ae802c9c3ccdeaf3aee14359369aabeecb3f78f89519b939638e7df7a0a697c191914aa7bbfa655c82cdb11fd3c3d182914a818ba093046f27af8e42408ac57f0e0a0805fdb143ef953f5d635a6a2893f387ea7254fe7795bceae675af32711b508bd841b9e7a233db8ccfd02a345e0f4", 0xa4, 0x400}], 0x2100c01, 0x0) dup2(r1, r0) 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)={0x41}, 0x38) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x43, 0x4}, 0xfffffffffffffe21) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f00000003c0)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYPTR64=&(0x7f0000000440)=ANY=[], @ANYRES32=0x0, @ANYBLOB="0000bdf5068bc7aae200", @ANYRES64=0x0, @ANYBLOB="5bf1cdcd71f9464b"], 0x7}, 0x1, 0x0, 0x0, 0x4044053}, 0x4048001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x1110882}, 0x69, &(0x7f00000004c0)={&(0x7f0000000540)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbf8, {}, [@NL80211_ATTR_WDEV={0x0, 0x99, {0x8, 0x2}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r6 = syz_open_procfs(0x0, &(0x7f0000000480)='uid_map\x00') r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)={0x20, r7, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x800, 0x1}}]}, 0x84}, 0x1, 0x0, 0x0, 0xc044}, 0x4040001) preadv(r6, &(0x7f00000017c0), 0x218, 0x0) r8 = openat$cgroup_type(r6, &(0x7f0000000140)='cgroup.type\x00', 0x2, 0x0) preadv(r8, &(0x7f0000000240)=[{&(0x7f0000000200)=""/8, 0x8}, {&(0x7f00000002c0)=""/210, 0xd2}], 0x2, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000040)={0x3, r4}) dup2(r1, r0) [ 1402.377374] Bluetooth: hci0: Frame reassembly failed (-84) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x80) r3 = socket$tipc(0x1e, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r3, r0) 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x5) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) [ 1402.722203] Bluetooth: hci1: Frame reassembly failed (-84) 22:11:02 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40087602, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) connect$nfc_llcp(r2, &(0x7f0000000040)={0x27, 0x0, 0x1, 0x1, 0x94, 0x2, "8cad21f8805e8e45425071c36bd719a89f6f71574dbff9ececf6d004885fe981ce6a922b30fb50cb04bf8165ce90db9193ad5190cfe66a2bcc7534cfdda5cb", 0x1}, 0x60) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ftruncate(r4, 0x7) dup2(r1, r0) r5 = socket$kcm(0x10, 0x3, 0x0) r6 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r5, 0x406, r6) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCDELDLCI(r6, 0x8981, &(0x7f0000000000)={'veth0_to_hsr\x00', 0x8}) [ 1403.094089] binder: 20018:20026 ioctl 40087602 20000280 returned -22 [ 1404.425161] Bluetooth: hci0: command 0x1003 tx timeout [ 1404.430757] Bluetooth: hci0: sending frame failed (-49) [ 1404.745166] Bluetooth: hci1: command 0x1003 tx timeout [ 1404.750711] Bluetooth: hci1: sending frame failed (-49) [ 1406.505001] Bluetooth: hci0: command 0x1001 tx timeout [ 1406.510383] Bluetooth: hci0: sending frame failed (-49) [ 1406.825061] Bluetooth: hci1: command 0x1001 tx timeout [ 1406.830470] Bluetooth: hci1: sending frame failed (-49) [ 1408.584877] Bluetooth: hci0: command 0x1009 tx timeout [ 1408.905039] Bluetooth: hci1: command 0x1009 tx timeout 22:11:12 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:11:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0)='wireguard\x00') sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r2, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@WGDEVICE_A_IFINDEX={0x8}]}, 0x1c}}, 0x4000000) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x5c, r2, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b='\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c='\xa0\xcb\x87\x9aG\xf5\xbcdL\x0ei?\xa6\xd01\xc7J\x15S\xb6\xe9\x01\xb9\xff/Q\x8cx\x04/\xb5B'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSIGACCEPT(r4, 0x4b4e, 0x2b) 22:11:12 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0xe) bind$tipc(r2, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:11:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:13 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000100)={0x800, 0xffffffff, 0x0, 'queue0\x00', 0xfffffff8}) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5437, &(0x7f0000000000)=0x2) 22:11:13 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 1413.087593] Bluetooth: hci0: Frame reassembly failed (-84) [ 1413.113288] Bluetooth: hci1: Frame reassembly failed (-84) 22:11:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x44, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipvlan0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6}]}]}, 0x44}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, r5, 0x0, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xce6c}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x48005) 22:11:13 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$KDDELIO(r1, 0x4b35, 0x400) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x4444c0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r4, 0x540a, 0x2) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r4, &(0x7f0000000040)={0x10}) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x400454d0, 0x1) 22:11:13 executing program 5: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) [ 1413.248473] IPVS: Error connecting to the multicast addr 22:11:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f00000000c0)=0x13) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvme-fabrics\x00', 0x94800, 0x0) dup2(r2, r7) 22:11:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:13 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f0000000000)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:11:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:11:13 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$VT_RESIZE(r6, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) [ 1415.154552] Bluetooth: hci1: command 0x1003 tx timeout [ 1415.161134] Bluetooth: hci1: sending frame failed (-49) [ 1415.167374] Bluetooth: hci0: command 0x1003 tx timeout [ 1415.172722] Bluetooth: hci0: sending frame failed (-49) [ 1417.224171] Bluetooth: hci0: command 0x1001 tx timeout [ 1417.224454] Bluetooth: hci1: command 0x1001 tx timeout [ 1417.229557] Bluetooth: hci0: sending frame failed (-49) [ 1417.244198] Bluetooth: hci1: sending frame failed (-49) [ 1419.304074] Bluetooth: hci1: command 0x1009 tx timeout [ 1419.309476] Bluetooth: hci0: command 0x1009 tx timeout 22:11:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000000)=0xffff) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r3, r0) 22:11:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:23 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x80086601, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:23 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00') r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x470bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$PPPOEIOCSFWD(r2, 0x4008b100, &(0x7f0000000000)={0x18, 0x0, {0x2, @local, 'hsr0\x00'}}) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x4e02c0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000140)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000000)={0xfb}, 0x1) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) getsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, &(0x7f0000000200), &(0x7f0000000240)=0x4) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000080)=0x2) 22:11:23 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$VT_RESIZE(r6, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:23 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000200)=""/1, &(0x7f0000000240)=0x1) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$int_out(r3, 0x2, &(0x7f0000000140)) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000000)) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$VT_RESIZE(r6, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x4, 0xb3d526e241efd4de) getsockname$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10) dup2(r1, r0) [ 1423.401095] binder: 20120:20137 ioctl 80086601 20000280 returned -22 22:11:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:23 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) r3 = syz_open_procfs(r2, &(0x7f0000000200)='net/unix\x00') setsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000140)=0x6, 0x1) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="04002bbd7000fbdbdf251d0000130800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) setsockopt$RDS_FREE_MR(r3, 0x114, 0x3, &(0x7f0000000040)={{0x5, 0x8}, 0x4}, 0x10) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000000)) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$VT_RESIZE(r6, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) 22:11:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="04002bbd7000fb911a03410000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) sendfile(r5, 0xffffffffffffffff, &(0x7f0000000240)=0x7, 0x4) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xfff}, &(0x7f0000000040)=0x8) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ocfs2_control\x00', 0x107300, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000080)={0x4, 0x400, 0x7, 0x3f, 0x75, 0xf584, 0x40, 0x800, r6}, 0x20) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r7, r0) 22:11:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x80087601, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:24 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x541c, &(0x7f0000000000)) 22:11:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:24 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x40004041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x3e, 0x0, 0x1}, 0x10) dup2(r1, r0) 22:11:24 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="04002bbd7000fb6801b0cf36f8dbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') setsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, &(0x7f0000000200)=0x1, 0x2) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="ff002bbd7004fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) sendmsg$FOU_CMD_GET(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x30, r3, 0x522f58c7ff5ac83f, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @local}]}, 0x30}}, 0x0) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r3, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x46}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}, @FOU_ATTR_PEER_V4={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x3c}}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast2}, @FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, [], 0x1}}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x54}, 0x4008040) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x12) 22:11:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:24 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:24 executing program 4: openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer\x00', 0x359383, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x82d00, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000080)={0x401, 0x9, {0xffffffffffffffff}, {r5}, 0x8, 0x7fffffff}) [ 1424.225497] Bluetooth: hci0: Frame reassembly failed (-84) [ 1424.229644] Bluetooth: hci0: Frame reassembly failed (-84) 22:11:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1424.274576] binder: 20179:20191 ioctl 80087601 20000280 returned -22 22:11:24 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:24 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000000)) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) 22:11:24 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) dup2(r1, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r6, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={r7, 0x7}, &(0x7f0000000140)=0x8) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000000)=""/224) 22:11:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:24 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x200000, 0x0) connect$unix(r2, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000100)) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1426.263426] Bluetooth: hci0: command 0x1003 tx timeout [ 1426.268840] Bluetooth: hci0: sending frame failed (-49) [ 1428.343351] Bluetooth: hci0: command 0x1001 tx timeout [ 1428.348791] Bluetooth: hci0: sending frame failed (-49) [ 1430.423157] Bluetooth: hci0: command 0x1009 tx timeout 22:11:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_DQEVENT(r1, 0x80885659, &(0x7f0000000100)={0x0, @frame_sync}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$PPPIOCGDEBUG(r1, 0x80047441, &(0x7f0000000240)) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) read$usbfs(0xffffffffffffffff, &(0x7f0000000280)=""/20, 0x14) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r3, 0x540a, 0x2) ioctl$KDADDIO(r3, 0x400455c8, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000200)=0x202, 0x4) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="423a9bc96bb1887cbb22b9b2da1c000000d07a98db1ce635dfcf3c85a57802940cf63af2f1087eb74748757e3a22faee9dfe61537bd83e0557eae0b24337ba740097613fa7d545626c639a9f1c26e378c442720ca184904123473ac57a61fd6d5a566dcafca7ff9a9107004bc90427f9d44bbf9ea4c802bd34671962e6b8d34beac642d1d220e89b80c26e9453aece", @ANYRES16=r5, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000fd6e210cbf09eed8c2ec31ac0386617dbaf5fa28db7f987d334002"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) waitid$P_PIDFD(0x3, r4, 0x0, 0x20000000, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:34 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r0, &(0x7f00000017c0), 0x218, 0x0) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000000)={0x400, 0x7fff}) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) 22:11:34 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40040, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = socket$kcm(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000003080)={'batadv_slave_1\x00', r6}) r8 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0356000013e1ffd5a0af4444d0fe8034448c3f584a96b4ff13001280c60c0074080005004aa37af28f2801892eed3a7a208c0f0d4b3bc8ffc220cf3cd0c4403db0d0a34e3b8d2237cf9246c1a4a697ac550875a87a891500075bde88723a6c062c505e728801659def040c38fed201af5ca6fb3c6c723c38ae45edcf9bc71093b1b5d7f6fd4504b9a2bfed300866089caa9a3df889f2298a247de4b31f663e18fcc201126318c313ffdd7f7dc95820ab8be6ffc45a26fc8e3865ca198e3f34e1982056356383c3360a732057abded2add980eff7c8ea8226859608433188ba38f60bf1f3210731144b8061b2b5559ad2070483c9", @ANYRES32=r9, @ANYBLOB], 0x3c}}, 0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000003180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000003140)={&(0x7f00000030c0)={0x54, 0x0, 0x8f69c2afecbff8d6, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r7}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xfffffffc}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r9}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x8055) fcntl$dupfd(r2, 0x406, r3) getsockopt$IP_SET_OP_GET_BYNAME(r2, 0x1, 0x53, &(0x7f0000000040)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000080)=0x28) dup2(r1, r0) 22:11:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:34 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r2, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) linkat(r1, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x400) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) [ 1434.830147] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:11:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1434.887470] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 22:11:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000100)=0x2) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x5) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000140)) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0x9, 0x5, 0x5, 0x10, "b664c131081b3caa0069d05798457001df656a"}) 22:11:34 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) write$nbd(r1, &(0x7f0000000200)={0x67446698, 0x1, 0x2, 0x4, 0x2, "31de37ed7e84be1adabf795bdd7e49e9624daed530cd4f733ccc11f869fbdbf6c02b888919a7650b5856775a60872c2048a6678c571e87c016f18b69eb92972eab66b1fa0604f439837f28"}, 0x5b) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40014045, 0x4}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f0000000040)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) syz_open_dev$media(&(0x7f0000000200)='/dev/media#\x00', 0x2, 0xa0000) r5 = accept$inet6(r3, 0x0, &(0x7f0000000300)) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@dev}, &(0x7f00000002c0)=0x14) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000080)={0x0, 0x5, "e3db19ddc36e6037b80b7d85451c6ee35178a60c2e7b88a014a78bd5e020b6bd55cbbd080e5cb8adaa06a28ddeb31515549c95c60b4f3d32e538d7f79c8b45f28ee8bdb31ef52a39fc132949bbb013ff0686d3c589d16f3def1cbb3d6fe6c4976ce5161667018eff561ba96faf6c442b5c452b0d35aa2e49da2797444366c5cf8be1c9b56b0736df52a7031115cf5287e4ce4739cc0279b258793430d57f812049d08b7b271e1be5b4473ea37459ce15c6b294ef0a3bac3c1fa30625c2f85926935d65342e302b41582bddec3eeaba9b50dbf98ae2b669e70efcc3e46c6eabdbe3b09536241fd187e70ce49a53dcf2c4217b73c7c508990ea5e6d45d9eb8d764"}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000340)={0x30, 0x12, 0x0, 0x19, 0x1, 0x2, 0x3, 0x12c, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0x3ff, 0x4) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) fsync(r0) dup2(r1, r0) 22:11:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:35 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) lookup_dcookie(0x80, &(0x7f0000000100)=""/4096, 0x1000) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000000)={0x3}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b2000010000049d67b932043c2e20d691484ba3d34473b8b7d7f2ee4ec12c53dbf"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x2, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x31905e13403123b7, 0x0, 0x0, {0xc}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r7, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r6, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000001100)={{{@in=@private, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@initdev}}, &(0x7f0000000080)=0xe8) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000001280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x40, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x57}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000840}, 0x811) [ 1435.044927] Bluetooth: hci0: Frame reassembly failed (-84) [ 1435.056314] Bluetooth: hci0: Frame reassembly failed (-84) 22:11:35 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040), 0x84000) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000140)=0x800) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 1435.113516] binder: 20276:20278 ioctl c018620c 20000000 returned -22 22:11:35 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040), 0x84000) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) [ 1435.189154] binder: 20276:20278 ioctl c018620c 20000000 returned -22 22:11:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:35 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) 22:11:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) [ 1437.062639] Bluetooth: hci0: command 0x1003 tx timeout [ 1437.070034] Bluetooth: hci0: sending frame failed (-49) [ 1439.142496] Bluetooth: hci0: command 0x1001 tx timeout [ 1439.147941] Bluetooth: hci0: sending frame failed (-49) [ 1441.222301] Bluetooth: hci0: command 0x1009 tx timeout 22:11:45 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040), 0x84000) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) 22:11:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6e12edf1767f157", 0xfcdc}], 0x1, &(0x7f0000000480)=[@op={0x18}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{0x0}, {&(0x7f000000b500)=""/153, 0x99}], 0x2}, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000100)='./file0\x00', 0x8000, 0x1, &(0x7f0000000140)=[{&(0x7f0000000300)="17f0b90a9de65eac7c5319422bb409748a915ce51dc677612ccfa007bfe33c5a038eab3304acef16da6586b5119759028d0fb8738307214c26dd41ce31a1052d9edc9606668775eaa2587a3cfc67bb34c7148f67fdbf0824c5ea0c35b0f46b12166c8c70156384e851dc527aa47ddc1e70511efe684733105baf4cb5937bab270041f3827955929eb9b01cd90a96a5f251c253f7d184c485ca7e85adb40ab558a1", 0xa1, 0x469}], 0x8000, &(0x7f00000003c0)={[{@usrquota='usrquota'}, {@nobarrier='nobarrier'}], [{@euid_eq={'euid', 0x3d, r5}}, {@fsmagic={'fsmagic', 0x3d, 0xfffffffffffff801}}, {@fsname={'fsname', 0x3d, '/keyringwlan0-\\'}}, {@audit='audit'}, {@fsname={'fsname', 0x3d, 'em1GPLmime_typeselfselinuxeth1'}}, {@measure='measure'}]}) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1, 0x0) ioctl$VFIO_GET_API_VERSION(r6, 0x3b64) dup2(r3, r2) 22:11:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x93) ioctl$KDADDIO(r0, 0x400455c8, 0x3ff) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040), 0x84000) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:45 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, &(0x7f0000000000)) r2 = socket$kcm(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r2, 0x406, r3) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000140)={'geneve0\x00', 0x6e0c}) ioctl$TCFLSH(r1, 0x540b, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f00000002c0)=""/200) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000040), 0x4) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:11:45 executing program 1: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x20000}, 0x10) socket$tipc(0x1e, 0x2, 0x0) dup2(r1, r0) prctl$PR_GET_SECCOMP(0x15) 22:11:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000040), 0x84000) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:45 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x830b43, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:45 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8, 0x101000) ioctl$TIOCGICOUNT(r2, 0x545d, 0x0) ioctl$VT_RELDISP(r1, 0x5605) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200000, 0x0) ioctl$VT_RELDISP(r3, 0x5605) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:11:45 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:46 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)='t', 0x1, 0xffffffffffffffff) keyctl$revoke(0x3, r2) keyctl$invalidate(0x15, r2) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r0, r0) 22:11:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:46 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffff, 0x2e8ac0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:11:46 executing program 3: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:46 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r1, 0x4004556d, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:46 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xffffff8b, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x48000) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r4, 0x2, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x1}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x4612, 0x4}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r9}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x40000) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x0, 0x2}, 0x10) dup2(r1, r0) 22:11:46 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) [ 1446.561989] Bluetooth: hci1: Frame reassembly failed (-84) [ 1448.021764] Bluetooth: hci0: command 0x1003 tx timeout [ 1448.027182] Bluetooth: hci0: sending frame failed (-49) [ 1448.591758] Bluetooth: hci1: command 0x1003 tx timeout [ 1448.597180] Bluetooth: hci1: sending frame failed (-49) [ 1450.101666] Bluetooth: hci0: command 0x1001 tx timeout [ 1450.107064] Bluetooth: hci0: sending frame failed (-49) [ 1450.661772] Bluetooth: hci1: command 0x1001 tx timeout [ 1450.667178] Bluetooth: hci1: sending frame failed (-49) [ 1452.181511] Bluetooth: hci0: command 0x1009 tx timeout [ 1452.741474] Bluetooth: hci1: command 0x1009 tx timeout 22:11:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:11:56 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$inet_dccp_buf(r2, 0x21, 0xd, &(0x7f0000000100)="25b382b4f69e26255be3160d6b1ee5091f202970e35e0478c09e7e0081c10e096bd19b493f0f895c7c7dad977bf5ff355be4d28206b409906cb8003ac5500de4ff306c82f32f81a7f4bb66dc459689202c42165d3917655aca14b520a498e974c440b98df4e2b63f2bf78da1581b9136c52b1a00e1fba9dbd3ff53bf4ba3a98431f09bad4c7c6d4db1a81c4d7d04fb83a4152ef87d5894324b8774475f5a342978acff9ff56e694d47b07bfc901825b26a576a25020bb72b0155378da2ae14315a80ef20ba43ab3c05fc08a36283708874cbab28d2862fdd5eb7e963e90089c6d693aa86dedb5ebc6b581cfbabcb85a452577be4740293993db9972b1edd84e7815be0005a4d7f2c60d1913c08776f290f92871e00564c0c83f82cf632f5d381e14e586a3f7c0ea2878281c0faaed1c46da2d3fc9dd58edad89d84c1e4278b667294084a6de8ae2d1622c7ac3978cae5ebb0245dff5a0e3c20f13ea1db6efe5b68bbf8f5ba5a524d17f51521c3fd8c6053049c868191c4cd4ff4628bc6998f6a3b415d7337bcd1c4d20560348a8115693b8be9962d0b19b614ca1d98fd429436a98dba84086d18146f910eb6be7bbeccad3d9ef2954a2b3825e321dd6aa11d62aa5aba245e56ef929e7137188c4db1d9a26bc13b835306578a137c68b380efb27f1137ff5891815b19fd0ca0a759c28a4212841edd9d0eb77e4c46a1db65a33b56d95e07aa30811b018fe5ad554f7a971c435ae02fc97b06f8ed06ea7457b8cc91f81ee5110f87e9a7d87af850bd90c7a4b7feb8eb5872831f60c25ecf04d52deea1345af6f5016b663372e5bb786bdd247872e9103713e61f1fb22974db63ef996d641bfc26806a1f36ffa9bfc0771d7b912bdc54bed312ec96f696e3d107f732ee4ddc960aed404bfd8bde81c6cfeb4e0ec46428414d3e7cd33f25849865159aa70eddc6afb30d727aa6622f8762c179c0eaf49b6ec7e22925b2b24ea8f0820c66cb92d54b8a5730b28479f9fcd8e28ec55a9b1f0832c291f13082bc35d1e3ca3d190db8f1a0b700a661f96daf0394c7ad0ab558edc3cde28e456cfbdb823b3741b1798d47eb5568fa48d6ba01170e93c0fe6113615c8370391d875c6980d4180c631524da0580030191696de5df2c983c21f06b41ece6a0903c63f9da83665b4e3ddc944a14dedb3b5c6e2955a927856a86a95d898e3f25fe5f91c23f60ed390578cd37906473b8b15cbaa1e4047382208c6471483304634b2d319f9242596bd4fb6b5962605a956e57f144b596749906ebeab225e5c6ddcfbf70050c2d427f5759314dd76e6360447f789d4f7d50c5bf050e38d4ebd4ffb11c82d02de2cb7c71b6a44eeebbdfd83e4775b0da094487a9ed4c249918da4b923e4b1388661424ec399258f1cd04c7f126bb04d29f0c6eb4d44719d1a8b5811d3f5f3c02e5ad21823113227001325ff04403e7baa82f78d53446c4b87f103989d8b278d764c2684de45db802f3faf5a852aad50d432340d948e7682a328f947f6944e95d985f3ed03b7982ed9c06e3ad31e3bdbc64c678df6d1b7aa301932a21dd38d3cd900001e37130dadea490cf0aabb4e03dd77d3093e6a797b2965d61be9bd0125ab1956ca0059d74f931dadddd447def2f5ae610698ce7c4cce680bb58cc26f51ae28515ce60e2e0b3904cf950b47ae971e952baf240696960bd8e83136df453013e17bd2ada0134b83e0b0afe5adc43484a5e5ca84e0a632200a875ced52a47b7d23b33d485845712da64d7d770bf11e273b422e85061d4a52f49d80716ab5369e73ab47d919af6cdde1a3028806ee69fc35e6e0c76cd81e9522b5811a392abd83db49644680a924f0fafc3bd02d1ae50baf287c3e90465eac584ec262b0edfa6f00d615ae700d809e13236f679d6f3edf15f0c4885936745ba7f9528192cbf3ff79b082a59fa6265f9698d72f8983aebdb23c000458492366215c9ec92081d6112ef8994a90a829d339a5ef22809b6f2864ad28d9171de60dfd26b19413e587295b5354e462131d9aac2bc17c6f57b9f4268f09c77be6b6ff3b64a59e177ba495e235732c078f9ced4753fdfcd0fd95874c0374a8f4c4a67bda1573830fa6f85a1b6325814a76dc47d9616ccc019dfde2c6c411ebf37aa3cd8b733974776cb3e24f30b7b1a9d384309908e587fb4fad1baadf9b98bc96ee1a1decb4cab519bc96a40d024b1c5bb3dc82a6a9f87536db41cc45d84908ca3ab295a420208165a1564dedec05641f532ef8d7513e12fe07fb35fc135a101d181be63507655b5d9d89a13e23e5ba80369781970d92c01e7676f70703c701db2e27632f36525706f9eae4470a55dfd87853157bd1b966715608453c9d17c1234b52cc81ac73712664e51c41b0e07135e7b67c37f9cfdfefabc380e95a269c1c4336dd4e499509ac30c9f434c61cd519d1000c2c1f60dc2b591c68fb63eda572b902b3634dab0df698beee0613de703457b429a7f9bb61f29c96cb120bf3fd874544439eee2f3b634c263413ba2009feb3b88d208e81130e7b590dee64ce583fef6d18ca3fc4dd2b639e878d7d3babf82adecacdc2628ee99e627c7e81e2f14e8bce53ef93fcacf0b40f05099e309e89e7d0f0131b3c11af8cdca87c72e222ae7257cc7948cbe3598c8b967dc53d097ceb09bee8cd0e43c559c37081f580bdd915694d02b136cd7d9241c05b4d846036dc2923aeff537d3c12a9035075aaac3e84c0a1e7de92a760e066ee5adb1d1551b16e863be939e2aff58ae5d0da1a16e5819fbfceb98c9bd3ef1584138ee9dcc26bd9dfa47dc318a869e30604391e65f88ff26caae53fe2a23c781502360485df45e2b89295de366d1f0d5c06ef2afc664254dadb4c1da0e92bf7fa10067e171b21e170050b5d86f55762a53deb2606c0fdff1d32be95fcc7a45d8e811a7c4de51d36b106c710b262a2bfa20c2671f04273f4f43e40d2197733a9c5a1ffdc69dd86552fc0bb958a9ad37ac316e581bb3247735429879298c581dc1d602e1cc5a6df0b50a1f1341b8065375b221671d3e79708e673b37218005bfdd072dd01ec61a5a80fe6fb367da8cf6e979894565eaae961dd53cf80b91e826096ef65d9ba0f5d7d97f315e180af6c166301b4eb2a3d6d97a38d914497703996b909b6849a5d7d0336bd6179ab125ad62c97da90c50af9def90606c4da12834e3a006a18f6de4ba56e4e545ba148ba71a4a21a0727d1321274551606f4ab423b5f1ce75050e42cbe8cd4ab1bfd4cacbcd14446a28a5a51ff3fb9aa1509b7bf4b976b5ab04fd7c0fa1b2c939ab145d41d58f26ecfff06f7d09a0eb1c5175b1190c5b5eaa6a658069dacedf9a2d4a61dfecbc1a5fd63af21d9e41dffe6f8d6c1179e7d46ff807eead4a3d2baaaa1142e9fca822e864cb503e7d59076ce6f8f2efcb4d86db27a0ec651c6b8e6425bb672d87c5265de506820098793d3a83721a7d46825c932e0468be974e88fd12045fb2add09d198882c5729e6d0cef94b1d2af294283ebe6815372c80609be509e143aa28ae8a746dafc6ca15f7e42ef74d541b217a1c4ac791241d7df86983f0eccb96aebfbb06477b9eed9d4cd10bbc81bf98dc8fbf3f68d93fb85e6d8ef8a6ea26280c29270e35e273dc8d366146ffec6220c0602e1364f63421a3ad8cc2bd63aab55fd089c0a8dfca3d95005c863cedcdf91f8ef6f4af34e9a0632fdcf83226687d97a4e0d71ce8ace178e8fb9a8bf0ae181ec24fbd18859091eeff7b76dc4039665579a34dc07e6df8076278a7624561ad10d4fe7c6b69ebc4fe9ca12931123ec0f8db4a6e04fdf3ba90179affc99f50487a6c2ecfbbe6bd5fca33396e331aac7afb5da7746527b9e0130c8b18a6b212088b0b16a73f5737b7dbe814ea89a0448624baaa12a5ff1e2da043e2a3f565ef141d05b076d60357d6a1112e61c7c6abfba3c5d07ae5b0f2f1714d792292835d528614896515a4e936e0b32e51ab18a8129a816ae96cc670d335ffa21678d080df31c2bdb16bb2f5aa99eeb00c594ab28eb8ab00f32e6ec53d27ba6266e540b1e4c5b9f9709ef475387bf95c0ddef76f629b39961ed5d1576df57926c1937461b78a8f0531cb39a739b62404f8e738ad8f5c5564ca076a84c05b8904753e8b9bd0d1b039f32581787924aafd39fd4662baaf8fa4ed73633a75d3b061b88452a30476e371e0b61b8ba0a899ca6fa5d78e2c1a1069927eddb0a16dba2a223504224af8325d37f3400c6db2cdb72c2cd541ec9ab981535c434f0d4842b67469a89cf95e927d24116c50e4e696863e6a683e5b7682e400df061cdf7a84b955937f9b14117cf8b0b171aa77e9f11ea9689dbe3a5c57ad01916cded007bfbc796ed61b4c4ad94fd30ea3f2f143c1d4bbf7cc8ab98dbc371b61227d0b928e1da749bd55e3f8d4e5d884427c3325813e6353a0d7509470b030ec3de212754d05189f8e804be25a68fef80589b5cb8471ddbbc9ac6de0a19d3b243f162470276af4e549697def8a78d9b04b8c387de85bc1e8e940ebb15b70e2c2ffcf1d8981313a27bb3f7249968444226d139da5a0b893eeecc03aa957ca8ed962fd0489a434466043ffacfe59cd72180f6f9fa0e930f6727e6a87c49b801db6514813d03b6529719e8262b18935fccd38184d99f97be786986995d4a8f072121526f0fc71964fcdbab0a8b7a5429ff79c65d712a3f2fc603fea8671c8f16de87b51bd846519c55b8aa64935630eec68c924aac82c9a3619b35c4ff6e4fbe5d22cc193352675da11d6e097bf4e331d2eb8f92e1cc0efd57df5a909b9c95fdb898743ed70aeb3d0f6a0f35d751de5c5d5d574d2c5a3aea03137a12add5d43c5c568e8cfa56daafaae3ca8de309e62f8fe19d9a0132023c44f97c82218e07d97387578b3e2d04f41029ace0695aacc1fd748383b16d58f0021972ddaabefb55a1589cb1916cc724c1840a45ac9ae9985c8709cb3288e9d1b8f0dc34bf25313d4dcaccfbb28b55e7f820e4f4c37fe9eb5af2eda6cbecd75626fd45921e26666b96ff7bdebfe0ba1f03a299ce0794699a68dadb5cf8ab6d13c275be6cac92137b16da83dd3913cc637f0927ad2b8cef0e4ade4e9147b3b9146aa9d673102c6c65b2fb7d66cfd7e90f3eeb6bcaad264191d422301a829cb64d0424032572aa34f02233b9873a2d61673550919ca86b28a014d33ff3dee9f582c6eb4db5fb5122f7732a4a57c82721d0d765c83ec041d204279b86a3c917a29a2c728e6269a67b9c42b6b257c2e20d77d81a58bc0f70eb901e9b4b89e452143a2e1e9fb628755dba85dc95aad881bfe1e8eb1d3002514eebd6faf3f969d989a2e15b4be84fc56e9cdb4dea51cda93837254e88bb2d66b3cc41068d53d9384773768d2f9f097b8d151a56e4c53ede0079d1daf56a2b866aa99167395539ca69f90ed0a64464843d563198aa24f73bf0d318016f8d51496935fc0cd47debcd23348a66b1a3f7e48dca745e5f8b94fe06512d52cf028ba38b3839337f570666966279c584c8143c2e62b2279240e29b00b329af2f8ea0c6d33369e8912ab17a5c286b33f9f8b838810627caee183a2f864a3a704fe10c2c3fe9840575f7da92cb836c0d29c7ad0fff2f26f4b5baf5307543b79a7c0a564cd84d88d2499423d1e0645632abf358a46da42892da2394cf8f24a43e54760806d2bb18dc29c205126cc2f563feca06d78eaa416486ed5043883485abe92ef235f5fd7e79e8eb84d0e57d31a1d0a94a353f27549891cc81de2c589d236d98f9b5", 0x1000) 22:11:56 executing program 3: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000440)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x28, r5, 0xf20aaac1f6a2385f, 0x0, 0x0, {}, [@SEG6_ATTR_DST={0x14, 0x1, @mcast2}]}, 0x28}}, 0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x64, r5, 0x700, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x6}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x10000, 0x951, 0xfffffeff]}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x6, 0x7f, 0x2]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x20000000) dup2(r1, r0) 22:11:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:11:56 executing program 3: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:56 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000000)) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1456.602647] Bluetooth: hci0: Frame reassembly failed (-84) 22:11:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) io_setup(0x8, &(0x7f0000000000)) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="0008000100"/22], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) accept4$x25(r2, &(0x7f0000000040), &(0x7f0000000080)=0x12, 0x800) dup2(r1, r0) 22:11:56 executing program 3: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000000)={0x1, 0xffff, 0xfffb}) 22:11:57 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:11:57 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 22:11:57 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETSW2(r3, 0x402c542c, &(0x7f0000000040)={0x20000000, 0x5, 0x2ec, 0x10001, 0x2, "88073867addd7c11dff0cf403ea4245a57c15b", 0x0, 0x9}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r4, 0x540a, 0x2) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f0000000000)=0x13) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x7, &(0x7f0000000080), &(0x7f0000000100)=0x18) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000000c0)=0x13) [ 1458.671006] Bluetooth: hci0: command 0x1003 tx timeout [ 1458.676455] Bluetooth: hci0: sending frame failed (-49) [ 1460.750903] Bluetooth: hci0: command 0x1001 tx timeout [ 1460.756291] Bluetooth: hci0: sending frame failed (-49) [ 1462.820724] Bluetooth: hci0: command 0x1009 tx timeout 22:12:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:12:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf25190000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f0000000080)=""/210) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r4 = dup2(r1, r0) ioctl$KVM_GET_XCRS(r4, 0x8188aea6, &(0x7f0000000000)={0x5, 0x1, [{0x7fff, 0x0, 0x2}, {0x5, 0x0, 0x5}, {0x0, 0x0, 0x5}, {0x3}, {0x52b, 0x0, 0x25638d99}]}) 22:12:06 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:12:06 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 22:12:06 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r2, 0x540a, 0x2) ioctl$KDFONTOP_GET(r2, 0x4b72, &(0x7f0000000000)={0x1, 0x1, 0x1004, 0x3, 0x198, &(0x7f0000000100)}) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCGETS(r3, 0x5401, &(0x7f0000000040)) 22:12:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306202, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:12:06 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, 0x0) [ 1466.837391] Bluetooth: hci0: Frame reassembly failed (-84) [ 1466.875040] binder: 20490:20506 ioctl c0306202 20000280 returned -22 22:12:06 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x7, 0x1, 0x3, 0x0, 0x0, {0xc, 0x0, 0x9}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x24004844) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x800, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYRES32=r2, @ANYRES32=r6, @ANYBLOB="29b179837e9cf5b1b7fe2bf3fd93c9be7b9e95083effedaf70d69fc718150c6d7d92adc0cdd94bbdafdc3ecb089e4c0f1f979a7ed6eb7c6cbc3e3418346c9660fb7ad1c2d7e08c4347dde74f4b518a111362a52eec103593a6ce6de38c0f43e2560f00a7002736bd012031054242500905f1b176e55fe184ec1af6bf3683f69baebc746f6e05c00fc2445bbf31567500bbcdab56fd305842342f0e206a42c467bc46ed391166db794fbe365b0ec88bc8bccbbce424f030210fd0a4677ebd91e4309194a401b8c0f397f9e39755d82550a7f97afea267d0aa2f972dbcd8c7e36e28b9d1464785383a7f8efbc965b8f088"], 0x5}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000000)={{0x2, 0x4e24, @multicast2}, {0x306, @local}, 0x4, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2b}}, 'netpci0\x00'}) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r8, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r7, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r7, 0x84, 0x23, &(0x7f0000000140)={0x0, 0xfff9}, 0x8) prctl$PR_SET_UNALIGN(0x6, 0x2) 22:12:06 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r2, r0) 22:12:06 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0xffff, 0xfffb}) 22:12:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setregid(r2, 0x0) setfsgid(r2) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r6 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000740)={0x98, 0x0, &(0x7f0000000580)=[@release={0x40046306, 0x1}, @acquire={0x40046305, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/221, 0xdd, 0x0, 0x4}, @flat=@handle={0x73682a85, 0xa, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/174, 0xae, 0x1, 0x11}}, &(0x7f0000000200)={0x0, 0x28, 0x40}}}, @increfs, @increfs, @request_death={0x400c630e, 0x2}, @clear_death={0x400c630f, 0x2}, @increfs_done={0x40106308, 0x1}], 0xe7, 0x0, &(0x7f0000000640)="4a4e1897db98c7d8f854e64db3a9d4ca947feb169dbf8f71e68a58f8e5f760ca07a0de89aac8ff4a1e8ecaec6451bf0036a0d12852745f649373c69ab06c40ef6a4f24fa6f19a9fca813e335a6d66d29f70333fed36fc0959f79fedc705aa921ae9a7aced7bab521cf72e320ac4355dc2ac6f40739fadbb1da2234e659163838034398fca3e7d5946d0b7324a65939038a53d1b3f9094afc70df87fb150c22940355f5157b0f667ecceb841ea1d691ceeeddae63509d6827659a0493d7401d8bd77608b9a6bc6b39136569b138e494b6278dad7b5c12837de49f48c15afb69e70716befec514b8"}) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001240)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="9f8200000000000000000f0000001c0007800c0004000000000000000000040003000000000000000000"], 0x30}}, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xa4, r8, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8a3c}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3f}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffff}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3f}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf01a}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xa8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x81}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8594}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xc300}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x2000c850}, 0x8080) dup2(r3, r0) 22:12:07 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1467.080227] netlink: 'syz-executor.2': attribute type 3 has an invalid length. [ 1467.128057] netlink: 'syz-executor.2': attribute type 3 has an invalid length. [ 1468.910221] Bluetooth: hci0: command 0x1003 tx timeout [ 1468.915662] Bluetooth: hci0: sending frame failed (-49) [ 1470.980114] Bluetooth: hci0: command 0x1001 tx timeout [ 1470.985505] Bluetooth: hci0: sending frame failed (-49) [ 1473.059981] Bluetooth: hci0: command 0x1009 tx timeout 22:12:16 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:12:16 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0x0, 0xfffb}) 22:12:16 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r1, 0x5e, 0x50}, 0x0, &(0x7f0000000100)="21eb408f2f2ffaaad86dcd097bd8a9db51f9f31239272f2ca68aacd1d93f01248a1fbac2d04541e10d15431fb71263933a3808b37ee310326fd0daada1f6a59bdeb409baabba80793eb793bc531ecf65ec3dda8611d01d68cd1704fc009a", &(0x7f0000000180)="9c2d723a87ceda11bc9a3dca190355a08f9e8c90626223cec6ee65d0fcf7bb54c689e532fd0400cb4c2f4c96c8a748285dc11d2d5e46b4a709b25c200f02ebe0ab3b2037963f86892adb45cc81238c33") setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:16 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @empty}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) ioctl$sock_TIOCOUTQ(r3, 0x5411, &(0x7f0000000140)) sendto$inet(r4, &(0x7f0000000200)="35338576375d47787ca2e33775bde4c6c81569113d0ae0c092d37fab70a42d45135114cf8cc9c2ef52bd4cd910598cde3c77b573a9eafd35de29138643131f390555ad9169750b42fe02066a96c1f4baae29c03914bc3c015d254650676d33d430d9d1088f7b8e7cf30ae42f8875e846d851cfe5ddf1eb1fa3b0e9a4976de68d4cd1ed318b2b155460903f47c8900a4b9b4e084e19df17a2134348f3ddaa00511f70686bb250588d10b075be308992506d645401685aaf83b3aa5f78f65c057bdf009acea8544f8f1c1c00a5ed79acb24a8ece8dd37bf04c424c752210", 0xdd, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000340)=ANY=[@ANYRES32=r6, @ANYBLOB="f9d0030009001fdfa198f9d522533fda6ed000ce00"], 0xe) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, &(0x7f0000000300)=0x4) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000000c0)=0x13) 22:12:16 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000040)={0x16c, 0x2, 0x2, 0x5, 0x0, 0x0, {0x3, 0x0, 0x8}, [@CTA_EXPECT_MASK={0xa4, 0x3, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @dev={0xfe, 0x80, [], 0x28}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @private=0xa010102}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0xac, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x90, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @dev={0xfe, 0x80, [], 0x18}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, [], 0x22}}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @multicast2}}}]}]}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x9}]}, 0x16c}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) ioctl$MON_IOCQ_RING_SIZE(r3, 0x9205) dup2(r1, r0) 22:12:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306203, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1477.055869] selinux_nlmsg_perm: 37 callbacks suppressed [ 1477.055883] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=514 sclass=netlink_route_socket pig=20546 comm=syz-executor.2 22:12:17 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='&\x00', 0xfffffffffffffffb) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:17 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0x0, 0xfffb}) [ 1477.109268] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=514 sclass=netlink_route_socket pig=20546 comm=syz-executor.2 22:12:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x28) r1 = socket$tipc(0x1e, 0xf, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:12:17 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1477.156434] binder: 20544:20559 ioctl c0306203 20000280 returned -22 22:12:17 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0x0, 0xfffb}) 22:12:17 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1479.149488] Bluetooth: hci0: command 0x1003 tx timeout [ 1479.154884] Bluetooth: hci0: sending frame failed (-49) [ 1481.219377] Bluetooth: hci0: command 0x1001 tx timeout [ 1481.225702] Bluetooth: hci0: sending frame failed (-49) [ 1483.299218] Bluetooth: hci0: command 0x1009 tx timeout 22:12:27 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:12:27 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000000)={0x2000}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r4, 0x540a, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) 22:12:27 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x0, 0xffff}) 22:12:27 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000200)={0x9b0000, 0x2, 0x7, r4, 0x0, &(0x7f0000000140)={0x980906, 0x1, [], @ptr=0xffffffffffff8001}}) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) ioctl$DRM_IOCTL_RES_CTX(r5, 0xc0106426, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) 22:12:27 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306209, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:12:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0xa3828712ce991a4a, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x11) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TCGETX(r1, 0x5432, &(0x7f0000000080)) 22:12:27 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x4000003f, 0x0, 0x2}, 0x10) socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000002, 0x13, 0xffffffffffffffff, 0x6) 22:12:27 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r3, 0x540a, 0x2) ioctl$TCXONC(r2, 0x540a, 0x1) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) 22:12:27 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1487.409037] binder: 20594:20611 ioctl c0306209 20000280 returned -22 22:12:27 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x5, 0x1, 0x4, 0x10001, 0x17, "39172c2489e134603f5edbc3d981ddb035ad20"}) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1489.388707] Bluetooth: hci0: command 0x1003 tx timeout [ 1489.395022] Bluetooth: hci0: sending frame failed (-49) [ 1491.458607] Bluetooth: hci0: command 0x1001 tx timeout [ 1491.463991] Bluetooth: hci0: sending frame failed (-49) [ 1493.538478] Bluetooth: hci0: command 0x1009 tx timeout 22:12:37 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000000)=0x2) 22:12:37 executing program 1: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) 22:12:37 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) lsetxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:devicekit_var_lib_t:s0\x00', 0x29, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:12:37 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f00000002c0)={0x2}) r4 = dup2(r1, r0) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f0000000040)={'filter\x00', 0x0, 0x0, 0x0, [], 0x9, &(0x7f0000000000)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x108) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000440)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x28, r8, 0xf20aaac1f6a2385f, 0x0, 0x0, {}, [@SEG6_ATTR_DST={0xffffffffffffffd6, 0x1, @mcast2}]}, 0x28}, 0x1, 0x0, 0x0, 0x14008810}, 0x0) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, r8, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xc39f}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x3c}}, 0x400c000) munlockall() 22:12:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:12:37 executing program 1: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x2) [ 1497.567248] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 22:12:37 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$KDSETMODE(r2, 0x4b3a, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:12:37 executing program 1: setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1497.617549] binder: 20649:20663 ioctl c0306225 20000280 returned -22 [ 1497.654300] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 22:12:37 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$SIOCX25SSUBSCRIP(r2, 0x89e1, &(0x7f0000000000)={'gretap0\x00', 0x0, 0x6}) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:12:37 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(0xffffffffffffffff, 0xae03, 0x100000000) [ 1499.618025] Bluetooth: hci0: command 0x1003 tx timeout [ 1499.623428] Bluetooth: hci0: sending frame failed (-49) [ 1501.697970] Bluetooth: hci0: command 0x1001 tx timeout [ 1501.703392] Bluetooth: hci0: sending frame failed (-49) [ 1503.777739] Bluetooth: hci0: command 0x1009 tx timeout 22:12:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:12:47 executing program 1: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:47 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f0000000040)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:12:47 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) ioctl$NS_GET_NSTYPE(0xffffffffffffffff, 0xb703, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:12:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:12:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306248, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:12:47 executing program 1: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:47 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000100)={0xca, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000080)={0x0, 0x100, 0x2, &(0x7f0000000040)=0x8001}) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f0000000000)=0x13) 22:12:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) [ 1507.850583] binder: 20698:20711 ioctl c0306248 20000280 returned -22 22:12:47 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b2000010000049d67b932043c2e20d691484ba3d34473b8b7d7f2ee4ec12c53dbf"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000000600)={0x0, 0x2, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r4, 0x31905e13403123b7, 0x0, 0x0, {0xc}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="000428ae7000fedbdf250d0000000500370001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x8894) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000100)) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0fc4086af7d4b17eda8724f53260b1aa4b608fd520909028bedf9e31d89ab56166111efdfb8c7e07131ea22cf86defc48353f153c40559335a246b856bce47b79fb9f36ac8c02815bc3c608f1c60760ec19745599f998391b38445127bb265741d44427502d20a73254e044b16014b8bc7e49013d9331269332ce976692389b457ce820407311227a08838dce0e4b9a268749b50048f453575b5afe55c2f35b104ba80", @ANYRES16=r8, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) getsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(r1, r0) 22:12:47 executing program 1: r0 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:47 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:12:48 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x2, 0x2, 0xfb, 0x7, 0x30, 0x2, 0x1, 0x7f, 0x1c, 0x2, 0x1, 0x81, 0x45e5}, {0x3, 0x8, 0x20, 0xe5, 0xc1, 0x7, 0x3, 0x7, 0x8, 0x9, 0x20, 0x0, 0x9}, {0x4, 0xfff9, 0x0, 0x2, 0x1, 0x8, 0x6, 0x3, 0x0, 0x7, 0x1, 0x3, 0x1}], 0x7ff}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r3, r3, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r4, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) getpgrp(r4) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000000)) 22:12:48 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:12:48 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:12:48 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1509.857253] Bluetooth: hci0: command 0x1003 tx timeout [ 1509.863925] Bluetooth: hci0: sending frame failed (-49) [ 1511.937145] Bluetooth: hci0: command 0x1001 tx timeout [ 1511.942563] Bluetooth: hci0: sending frame failed (-49) [ 1514.017050] Bluetooth: hci0: command 0x1009 tx timeout 22:12:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:12:57 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = socket$kcm(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r2, 0x406, r3) shutdown(r2, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:12:57 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:57 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) 22:12:57 executing program 2: r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r1, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x218, 0x0) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f0000000380)={0x20}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x4101, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8001, 0x4, 0x7, 0x1ff}]}) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x2}, 0x10) getsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000140), &(0x7f0000000200)=0x4) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r5, 0x540a, 0x2) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="01000000268271a44b61f1c5c2d6c2db7688ec82e3933bf20207177f7579e056017b561270e6efa1d06069012ce1f2c5b77d1842ede6bc3222f38c", @ANYRES16=r5, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x3}, 0x1, 0x0, 0x0, 0x4041}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000002c0)={0x1, &(0x7f0000000240)=[{0x92c, 0x86, 0x80, 0xffff}]}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) dup2(r3, r0) 22:12:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306263, &(0x7f0000000280)={0xd, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:12:58 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x1a000, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r2, 0x4010641a, &(0x7f0000000100)={0x8, &(0x7f0000000080)=[0x0, 0x2, 0x101, 0x0, 0x10001, 0x54, 0xba1e, 0x6]}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f0000000000)=0x13) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000180)) [ 1518.022912] audit: type=1326 audit(1588111977.993:28): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=20764 comm="syz-executor.2" exe="/root/syz-executor.2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f66a code=0x0 22:12:58 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:58 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) [ 1518.067051] binder: 20763:20774 ioctl c0306263 20000280 returned -22 22:12:58 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvram\x00', 0xb220f34e594e0a13, 0x0) ioctl$VT_RELDISP(r2, 0x5605) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbafd826b2d672d2cd00010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000)=0x4, 0x4) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x5412, &(0x7f00000000c0)=0x13) 22:12:58 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:12:58 executing program 3: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) [ 1518.788939] audit: type=1326 audit(1588111978.763:29): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=20764 comm="syz-executor.2" exe="/root/syz-executor.2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f66a code=0x0 [ 1520.096683] Bluetooth: hci0: command 0x1003 tx timeout [ 1520.102082] Bluetooth: hci0: sending frame failed (-49) [ 1522.176515] Bluetooth: hci0: command 0x1001 tx timeout [ 1522.182033] Bluetooth: hci0: sending frame failed (-49) [ 1524.256287] Bluetooth: hci0: command 0x1009 tx timeout 22:13:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:13:08 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:08 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:13:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x48, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="04002bbd7000fbdbdf251d0000000800011000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @multicast2}, 0x2, 0x4, 0x2}}, 0x2e) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r3, r0) 22:13:08 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r0, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:13:08 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000000)) [ 1528.331977] binder: 20816:20831 ioctl c0306201 20000280 returned -14 22:13:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:08 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1530.335830] Bluetooth: hci0: command 0x1003 tx timeout [ 1530.341211] Bluetooth: hci0: sending frame failed (-49) [ 1532.415724] Bluetooth: hci0: command 0x1001 tx timeout [ 1532.421184] Bluetooth: hci0: sending frame failed (-49) [ 1534.495550] Bluetooth: hci0: command 0x1009 tx timeout 22:13:18 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:13:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x2, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x40}, 0x10) 22:13:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:18 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b2000010000049d67b932043c2e20d691484ba3d34473b8b7d7f2ee4ec12c53dbf"], 0x48}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000600)={0x0, 0x2, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r1, 0x31905e13403123b7, 0x0, 0x0, {0xc}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x20002000) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f00000000c0)=0x13) 22:13:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x105200, 0x0) ioctl$TIOCNXCL(r1, 0x540d) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r3 = dup2(r2, r0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x10d000, 0x0) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000040)={0x8, 0x0, 0x1, 0xfffff800, 0x6, "0fd149e069d21cfa914e1196c213c3cb95f29d"}) ioctl$SIOCX25SCUDMATCHLEN(r3, 0x89e7, &(0x7f00000000c0)={0x5a}) 22:13:18 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1538.593232] binder: 20861:20879 unknown command 16388 [ 1538.602534] binder: 20861:20879 ioctl c0306201 20000280 returned -22 22:13:18 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="d5871be52beb5ec6fafb9f83720e2f64205b8040aa087be45c932860bcc2e61a9f92b457229d3027c9d7d03e0aa8f1", @ANYRES16=r2, @ANYBLOB="0300984007f8fe31592931d92438eb86e6000000ff00"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) sendto$phonet(r1, &(0x7f0000000000)="bf591932d9b7c0e58c1eac419e89670fa79b3c51781b", 0x16, 0x455b0fafa1bb7032, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) dup2(r3, r0) [ 1540.575136] Bluetooth: hci0: command 0x1003 tx timeout [ 1540.580536] Bluetooth: hci0: sending frame failed (-49) [ 1542.655805] Bluetooth: hci0: command 0x1001 tx timeout [ 1542.661299] Bluetooth: hci0: sending frame failed (-49) [ 1544.734887] Bluetooth: hci0: command 0x1009 tx timeout 22:13:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:13:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:28 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:28 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000580)={&(0x7f0000000300)={0x24, r3, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x6000080}, 0x20000014) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x2000024d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x97}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f000000b000)={&(0x7f0000000500)=ANY=[@ANYBLOB="240085001800210000000000000000001c140000fe000001000000000000000000000000a5cd931d245e2d20dfcbbc5e514e651bb0d3c387af0fa90d90d5f6f63cc31da6a432259ef7c286ea92a8ac7c6509f290579a592eefc8e9b49588d753e93c1995"], 0x1}}, 0x0) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000340)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_REMOVE(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x70, r5, 0x300, 0x0, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, '\v\x00'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}]}, 0x70}}, 0x40) sendmsg$NLBL_MGMT_C_LISTDEF(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r5, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0x40890) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f00000000c0)=0x13) setsockopt$CAN_RAW_LOOPBACK(r4, 0x65, 0x3, &(0x7f0000000480)=0x1, 0x4) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f00000002c0)={0x3, 0x6, 0x4}) 22:13:28 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x2b0840, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="1c000000c56763d1833283662a03f817ec33a8c900e5683d0dd314aa900d1af3228e5cfa031b53f722564eda97b67571c56ce6464392ebd618a491cfcfdd4181be059f36527c4c10a9b8e1f60127b26ccf1398e0e1705e979d6c11cbc80ec71505af53659ff3857e7330eb1da2b9f3df3951655a9c4f99541f39f07245783c25386caf88067bbf31b6c6e8da60242b832c68d95dc8fc22f8e870a99be892a3d073e123289796c904d33acf31aaf7be19262088f629f5afd3c39a5fe703a2ce5ae50c8c589e9645392e01d4d2df4e075b60151bda324c94bbc705ad1a9aa3195f8621af35b039", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x20a}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/106, 0x2ce}, {&(0x7f0000000740)=""/73, 0x3dd}, {&(0x7f0000000200)=""/77, 0x2000024d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/22, 0xa}], 0x81, &(0x7f0000000600)=""/191, 0x97}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f000000b000)={&(0x7f0000000500)=ANY=[@ANYBLOB="240085001800210000000000000000001c140000fe000001000000000000000000000000a5cd931d245e2d20dfcbbc5e514e653cc31da6a4326509f290579a592eefc8e9b49588d753d53c1995"], 0x1}}, 0x0) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000340)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_LISTDEF(r5, &(0x7f00000004c0)={&(0x7f00000002c0), 0xc, &(0x7f00000003c0)={&(0x7f0000000440)={0x44, r6, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_DOMAIN={0x15, 0x1, '/proc/partitions\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040050}, 0x4081) sendmsg$NLBL_MGMT_C_REMOVE(r4, &(0x7f0000000940)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x70, r6, 0x300, 0x0, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @remote}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, '\v\x00'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}]}, 0x70}}, 0x40) sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, r6, 0x200, 0x70bd2b, 0x25dfdbf9}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x4000) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000040)={0x6c, "2961cb271993eeefcc0a2ddd4533fac2e6aa63113babc730e8bd9410b87a1b723547e2e1afd7f1ce48a02f70f8d2c3ad385b68d360f6d55133ee51ac02f702d54c8e0ce048970ce47980625d58a1a536fb64e31444fc0e1f05704ca59f318d772411307aaa71a7c56b71b5cc"}) 22:13:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) [ 1548.714682] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20915 comm=syz-executor.2 22:13:28 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1548.767138] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=20926 comm=syz-executor.2 [ 1548.803064] binder: 20913:20931 unknown command 64 22:13:28 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000040)={0x9b0000, 0xfff, 0x7fff, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x9a0001, 0x6}}) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000800", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf401d000000000000008cc9ffd2020800beb08cddc436bc75175c7abc88a86bdfdd727b4c33a2659cd68522738e16212fb9a52c3c3cf20b6793e41402fb9ab65a30b9f1ad9c050900000083155c24d3edf4e710bbca7b0e57699633d195122a"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000280)={'wg0\x00', 0x200}) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000100)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r4, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000002c0)={0xad, 0x1, 0x4, 0x0, 0x7, {0x0, 0xea60}, {0x3, 0x2, 0x0, 0x0, 0xff, 0x60, "49bb3814"}, 0x3, 0x2, @offset=0x7, 0x9a, 0x0, 0xffffffffffffffff}) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f00000003c0)=@nat={'nat\x00', 0x1b, 0x5, 0x508, 0x160, 0x278, 0xffffffff, 0x368, 0x160, 0x438, 0x438, 0xffffffff, 0x438, 0x438, 0x5, &(0x7f0000000340), {[{{@ipv6={@private0={0xfc, 0x0, [], 0x1}, @rand_addr=' \x01\x00', [0x0, 0xffffffff, 0xffffff00], [0xffffffff, 0xff, 0xff000000, 0xff], 'team_slave_1\x00', 'geneve0\x00', {0xff}, {0xff}, 0x2f, 0x5, 0x0, 0xc}, 0x0, 0x118, 0x160, 0x0, {}, [@common=@eui64={{0x28, 'eui64\x00'}}, @common=@hbh={{0x48, 'hbh\x00'}, {0xfc, 0x0, 0x0, [0x8, 0x2, 0x200, 0x4, 0x3, 0x4, 0x9, 0x1ff, 0x80, 0x0, 0x3f, 0x9, 0x1, 0x626, 0x200, 0x7], 0x7}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@mcast2, @ipv6=@loopback, @icmp_id=0x68, @gre_key=0x5}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, [], 0x1, 0x0}, [0x0, 0x0, 0xffffffff, 0xff000000], [0x0, 0xffffffff, 0xffffffff, 0xff000000], 'xfrm0\x00', 'ip6gretap0\x00', {}, {0xff}, 0x87, 0x5, 0x5, 0x3}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@dst={{0x48, 'dst\x00'}, {0x0, 0x7, 0x1, [0x20, 0x6, 0xff, 0xe, 0xfffa, 0x80, 0x4, 0x3, 0x7f, 0x0, 0x401, 0x1f, 0x800, 0x80, 0x1ff, 0x4]}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x2, 0x8, 0x6}}}, {{@ipv6={@local, @mcast1, [0x0, 0x0, 0xff], [0xff000000, 0xffffffff, 0x0, 0xffffff00], 'gretap0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x67, 0x3, 0x4, 0x3}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0xa, @ipv4=@multicast1, @ipv6=@mcast1, @gre_key=0x1000, @gre_key=0x1f2}}}, {{@ipv6={@local, @local, [0xffffff00, 0xffffff00, 0xff, 0xffffffff], [0xffffffff, 0xffffffff, 0x0, 0xffffffff], 'veth0\x00', 'veth0_vlan\x00', {}, {}, 0x21, 0x81, 0x3, 0x10}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x9}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x568) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000000c0)=0x13) 22:13:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:28 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r2, 0x5412, &(0x7f00000000c0)=0x13) ioctl$TIOCNOTTY(r2, 0x5422) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="04002bbdd1a4301129bf20bae63ee6c3360fe8aa1b0d6b9bf03efd9dd1592ac10000006412f2d9b3ef25546fe399f225846c280038e2b8b55e9f6252c32db92855aec2f3b16cdb26f74564fcdd840c15ab4f3ab300064c461cf0ce2c87e75c84a9d03431dc329949e71bcbfe09ba5d02dfbf40d20dba28fe956c55201c4152c895f73de034149f45f104626484dfc90183cef21eddbb41447b3a8dc07cd6698ec650b4021285297036b310bb26efce7f32994b"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x5412, &(0x7f00000000c0)=0x13) preadv(r5, &(0x7f00000017c0), 0x0, 0x4000000001) ioctl$DRM_IOCTL_SET_MASTER(r3, 0x641e) [ 1548.823897] binder: 20913:20931 ioctl c0306201 20000280 returned -22 22:13:28 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) 22:13:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1549.601738] binder: 20953:20957 unknown command 0 [ 1549.606721] binder: 20953:20957 ioctl c0306201 20000280 returned -22 [ 1550.824437] Bluetooth: hci0: command 0x1003 tx timeout [ 1550.829836] Bluetooth: hci0: sending frame failed (-49) [ 1552.894185] Bluetooth: hci0: command 0x1001 tx timeout [ 1552.899631] Bluetooth: hci0: sending frame failed (-49) [ 1554.974084] Bluetooth: hci0: command 0x1009 tx timeout 22:13:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:13:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:38 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) 22:13:38 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self\x00', 0x2000, 0x0) write$binfmt_script(r2, &(0x7f0000001140)={'#! ', './file0', [{0x20, '}'}, {}, {0x20, '/proc/self\x00'}, {0x20, '#! '}, {0x20, 'wlan1proc,&#\xd7em1'}, {0x20, '/proc/self\x00'}, {0x20, '#! '}, {0x20, 'security{em1procmime_type)trusted'}], 0xa, "20dadd4e0d6f5d181a2bd1b07432dccf5189cbf4f37bc31174e1daec5d6f4741667a2a579c382832ef7f8817544bbd2d6c5de52d12adea766ca3d664143d458154e9a3e50a76bccc73a1ef267b5f78a14ef9b45032461a824131842fdbebf0ce56c9e55ec37a1d186e3f3d68f05fb8abef0db575123ec757706a22f0cd8a08e912801d8d43e46cd4c40235bb9841aad405b1c5cb73e7ab1766bd6903133c8d08347c556eea56237ec1d68fab7c5f2315336349071217d5ff5b42220cc6313a7531f77562f9b88e315b37f568bda51fb6bcf58219a5b2772b1eb82c6a0ca338568a0dabe3c556dbf2b05c4293f06a94b5935c4b4a8b4f33f6959087e22c80ab2c6f804dd8ad9227c6e3bc95cdf64abb65816082c92df6e5290ead5b6279614484f858c337b9149429b2e99a4475b4cf2a07fd9853c0234a7314335257717df430b54dc66ac919d20cb154cedf72b61eb16f582562aaa4c509f9bd7c85384bec97cae448f8926d9eb22b2759aed5012e5624c627d3c8d7564880f2ad25d028dcb6bea4407bd4b93323df58d892383d63b8bd8c76324679d4bf9a33a79f5353ee02cbc2ded3d5747c0b74fa6cd63ad1b48deb591cad6676314ea30dce3ad92fba51057941b272dff69be25392ce665fd9978b71d615c7ae4c75d4da64a3e9dfe2a4142c30745d4b51dd96bd6f9b2a3b06191e696d6b1c8a3a357e227291434e6c002f2b27cd88d14896748e72d589892c8f65695feb434dd82a9315db816cae8448aba0df079d447c6c9099e28e0e2e3f1d5de3305cdbeacb367712e698230572276460789ab19f90283a01828dc4098b714c0b38080d8a2c28cce473269a45c73e8c4ca733d108bcdf35cb6df1b8141b3e2096d83c74557e13940513b61e1c4395d04f1dc30bf10a45c7090902718e554814a3d15229bf2f9fc7b6bdecd07dbeb8a1607181a803454860895a23fecbf43cfb8013101af0f7be3df92a47c12b9f0b57d0b7e028838ea08ee175bf9992daa95ebaef53f13937660505435f586e49ec18a8ff1af9338311780a96fde494b3e756daf8a35b0962b79b00c183d8b8433a9674d857c24009fc0b0dceeef16664a06478323ae55ed1a4d8979a3807c3ff5d86dacc59a3d27e3461897d98278b65403d2eba84ba146f9a25bc04ee324785ca2a08c7f6b3b7dc7b92baa5d602b7bb0684afab04eae59525b8c1e3ae0d6f35faf199e4e69a35500fe561b16a7056aa489f0e15d429b732cb8d902de652fc991396e4ce9251087e31fc2e4a896aed464b9369a2dde656641e781a607b7f65be0b96da0e9b6cfbcbe1f496952fa2ef2f2d10c6c21c256d0c3f06dd0f926feb62bf204478a57db9a222e596a8ff49f081c4d17fa480b77ecc0e923b0646e87648984e9e36c30d245d16bede987b9dbc2706788fda4594cef21d441fa9e950d2967faa34aecd18d815d7b207d6fc548d452f94b3223fcdf48fad09da47a81dabb7691aa52ba419dbf9b4f76b660098e15b8acf5cef9307ef47530ec62c67780a307a6d6da218d00bf2065895582f293861a3349774e380edec5a9e054be8256fb8ea31ab7d33d6337b0ab32b976d383afe9b6450842733735fe424c0e31e19f49e56e97e16b218a524c2656f1f3c159219f6f6c740a97c1c3ff643e2c76d8fdd15aaab0c03537c767f9e20faa724840bd70a17cfe31c25982397c668bc2f756a2ebb7ab7f99425e24d420a73cec7a78a298356f980ecfafccc3728f94dc61b8c855213ef42b071c2c493179c3d77d43ebe5d3c1ff15f823dc425cc7bca68f95c75c866ea118248d91653a79f43a8b5450f92ffbe44c9bd0f9752d1dc4e9827f4999d004b934ac35c941d8e7e99e13af854162309f91cde5042ffb93bcabf6fe1cd7433ce76e8c78b00c05da5c311fb2bf286546511fe2132c38d07191830e76d73f7180cef36248ae9f8676df43c4f89101c6364e56292a7d754a14d649f313897847630a928f9b2a7c16da2590baa7f34db84a403d0c788404a7f695d51839a5c44febdbdf4605897d2b0e9b9ca254ae399595610ee38129c386003a9b493ba06c8a4fbb57d5176a709f977d32c8520b3cdca8f8b224c57addad2375a20c3409dc067248bd1f5792dc8667382b7b462d719bbb6cc2806d5e13dad7818bddd924a55384bbb5d5a4d1eb9bb61ab6d582889858e290736f055191c30b631b29318052fd67863c28260327ce979dc9788a9b96b1ca4cb4bc88f6a275994c582578391a3b559cd06413b6600dd51b6687b96e746030d140ab7b9a945df078f14e491ab9dbb03332ad6360a7695de156dbd2c9c07ab3a4cbc2ab337f2d2af1612e706f32ac18e08ff3e8b5bcfbf084efc808cc367e165c3b1174105b6879909d115daf9a24927bcd3dcb98f99dfd7988789e53e90db72a13de14db336d7fcd1de39dd351545d68ae621b41c5063f870e2ee91566a192923e8f1b15accc9dd96ec2124769d4ce042a4c8701a1249f17370b2dd369487a8ce07ee356f71aa2de11194ca0c8325bf09499f86740138559c9dc9b49d61241b67e0f57ee5e522789120d786e4043d88be2c193d972390fe7dd93dbd9b5c2857655ebf4e985a763640f8240efccd5a5e553d0d8d2382c3970c99c016e1cdc3a6b84f440661337ca7bab0c4f05e4e3014905de4cd0d50e423b0445af324aa5bffccf0396d88dc52e3763d6156ca9c523e840f18bfd0c5716c90500a3c1d1734baabe64f808a150a8ac7bddd4e01f636584e8a3d1701635b4aaa04fd07614e075b25dd06a04797b2f70780f5fcdd579dcaa9c6c8cb461aa3cc38206849fa98792a391c8ef909be9dc797a11b8616cc9bc3511d9a9872c76e23e8406b55fffb4150b10a2d09ba997ca742f70b0f213552449c2f6085071f5a64f8075c786366d935ae425c3cbed504e2092f57d07d415dd999b9569d87de5cf5a416418b53ae94c9ab0a83c617695beb1f411ada7e0381b4295bd7ed16fecef8edf45afc27b88327875c12eecad0fadc54ea2c0b6b19187e03139d62c01c94281412d84e76ed78384b80b2feea3d0615d5445c5f23fb23bec24e516cea72552f7bffe71bc1e6411e8a4d9e83e62a5a37efe8d49be0d27101c1ed22b6806866c1f24254c59405034a630644e75ce16bea5f8e96a8a41c513a85fc141116dc75c864c5ac91038891e987d379ffbd18cab9de20275c74bb27822977a7eac8c8c6ecc4172edeedf8325e74685ea04ff96077f5fd1b65f84923fd248ec3bda29a70152fccdc49a0fda7f3827e7d13bcde1b2c4231e5928ea83d641ccff7788c21cd75c4f8c1ae3a966b80c18a6ab16951bbf3e1c53bb828a08ed66e737b9ed9615bcf5bd21f516f05ac4fbc1790465ec12caf0a82bf677f4c778d7127e287f0022697791e9eca6c8f34805ef9918248e2952549ec98bd52b376366464be49227b3c84ef1201f8bc4b52881c819ce9c760a89527a00ee3e81c45965c98dac206aac167d0b0feb569a3782a5005f383e9fd0f2171b633b314c51a94a748d3513741041b2fb981ba53ff1b1d2bbf6a9ded69c0ec06c61c772e56c716f9a0924ac52f855b0ae85d4473a876d26879f732ffd2538da9a2652fd4245081e9b2806003aa440a7bf2047cb3ffa448db2a2e0a545591789525c8b9a03dc850b94b49c32e60aa544cab7bdf2a07d37780abc800362ae96517e07fd87ad559bc9d5c23dc78d774a3344d1b3ab369f140e19b7d363756099ec767e14086c14a497f1c9d9766b82524b667fb22ce598226d0cd63a05cf4e42fc6d1ee1b0cca69cd39b5961861a5d7393c8a77ec6be67c2141e82bd6b37d675bc509ed80fc3d007ce4f46eb3e89559968a819c359b6b43cdf26f87a59300861651fdbb6ace82217c3dee68b3a07e2524344a05a9a08cfd65145a46be8f3e56da5f8b19a4b576bede6b7d2b550f42983cecede2de5e707551639823797420667443df843d17e4a938bf8b2f789a669446d0fe67fa34d86eb4872e99dd416e95a399129ba998043a2a45f03c45e6ca1df63d42b6cc4232274f24334b07dcf91989757407ef9b5289fdee289590c9fd16ad7c46be6dd0ac34ce25fcfc72d5d94e69a04fb21384d76715cea5591fd0a86c396aa3b0823e2db5cdc7fc30597682e468569bf989cb0bbd9ff5c745efc12a6aa928887f29b2774a2b58a467ff691c98b9ff7742a08dfabdea95bc8604380f4dc32de45a5d86a98dbc93743bcd751444641949e81b8213f9b4f5d4f677a8b998ff34f0c728fa03028075ce71b09535a36f10cd07575d17c361cad2a4693acbc246ed6184d5f008ffdb600867f2b6b7d8bfdcfad0cafaa306d2ea3e5a2923358737244294ede18f0ffa3db30f1975aa8705fd03b17cbf4e6c16fc5b7fd11e468ac45c1bcdeea8b42266eab08d29aea7b724bd5ab9e523094820efb77d103761542472d3b97a981125f276e55b94631d8ac04fe2759391212e1e80a65c001d19e4ca5ca5cb651329204340fcafad746220015e335d51bf067e6f1811bf5fb921d73113d17a24919f823e4abdc87c19aa8f8189a760f9ff0b33e8877b80dfd6dec0cc061bb2f60a7e3a9e8612f2be5b41ae142a0f25e01ed1f20cd9310ca2859b39facb146cb6750539c9825874536c8de95fd1230cd4f263d13c360be7d2556c6fe0f988ba723dda38044af6a858e6a127884fdae18113f184e4cfcebc4f870f4e634179306c363e71f94171e3ed2aa94bd935e0ad6370020b4ce9a666b0979bcebc4f02ad5209bcb48170431a0f107520e95075bf836566928de315059d6c47e3a3119f381755995aabb81330f2319dd69703f611d05f414ae47ea65ef6fbf7635bbeb7ddaa6bffd5b54c1a839e6eb2bd7dddf74e636a4d5465337c41967892595e4415009f84e756a2a263189b58d3aa4da61ac115761b9c7167df4e917a30580cc7481431a634da59e584ee56b82548611cb92f37cd71930943df31c366c77b18b8db91630ed49eba080a8b82246a048f95c49d38c232a42e91c848367dd63611e7504cbe4b3d8f29e09d0a51eeed256f573c28476dfbc4cdc1d1fae0673464546caa37682aa0ad18580a9c3264cb7367ad2994b27f2ff366ce37e98ba6c2a980c9fd08a7677383811b5a56fce63b0bde89575a0a69cd1e7f5414ac54dad2bb0d4ad44bb08c6541f2964a08bb554506bf9de26a32bb5c6b45ea123d5327b9d5fada98e4f2606e3c87988dbfd4a083fd605e6f339cf9d816d210cceba2e4f9761998aae6f7188cb33e15c1a5f03d2fb616b8fefb24a8cc07465920744ffdacf81c205f9559279b0d1357c274b2ae05f0a7ef3ddba552d5525bff42840b709defa406e71e4260edb5d305f38da62586c8da4c152d516a8d43b7cbc86945a3fc9b176010e82fd84571efec594462e10d58c0b8484a4cca7f2516a5617de12fafba2c8a0a3332c6a89a4be0b38f552215488f64928b56391cad874964ac21cd9dc63e7b1ae009b8b8f975bf438b55188f217aa3d6d1fa0b38afb98c022cab69551b056743ca98e4a1d16975fd6c93f6025b0be82c565ea1104911c1539a90cba3a94838cd4ea0712d56acb6cdff68fd73930ada87fc54f56cbb252dfe3e57706e3f4d630bc23d59ad5986162adbfc1805e2c68f582d4b5daa1a97531b5f123721d2c8b6f01650be0378bf5a8a12a5edd344fc123130f59b71808cb9b5b86faa1260ae5fcce847a5288a9e7583e0f3bd2d1acc9c554b8990b453e94f478a06387ee40df04db5b138c130e61ae463c1194d49423221265e4a74"}, 0x1061) 22:13:38 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r1, 0x406, r2) sendmsg$sock(r2, &(0x7f0000000500)={&(0x7f0000000040)=@isdn={0x22, 0x0, 0xff, 0x2, 0x8}, 0x80, &(0x7f0000000480)=[{&(0x7f00000000c0)="a40700f8e5746293796b69a8560082ed906ccbbe3d2fd9e87fc0f66211a1acdb77cd672b8752aed6d3ecf80714a97cad34be046a6ddf36930a3a47d9df9d4b883c4e81aece848b0436331d5ae5227649432dfdcaba211e7e23131a4a2b24a5bd08abb53029c21cfb2eebd84a06cb72a74b20778a24ff2b9e62f0fe87bae41e4ed27e", 0x82}, {&(0x7f0000000180)="2bd90e401fbf57a520d97b37566ac925b2499dc8203a33ae5309eff5cb2226cc038aa3dedb4a9c15f8d1217af2d8a1eb96cdc5dd1fe04861b9838639364414ef4c16a51c916634643239736407d4a7af5fe1cb227faf35ad39bdb8e44b9af22c62d990c800f164eb34d6ca8c185bcf2f2b56070fa84c", 0x76}, {&(0x7f0000000380)="edde97bec1b4c2efb55d74d6577c05ce6efb8727c31790198d233ebede99d4440a51496ed4a77892503c84d474210cb29112ced3a98d4f9cbb9b45e2fb6ce9f2cf47e6d07d9c9a991ddfc81608c4588a5e534a02ae53b07bb2d2a353d0910eb29de66f996dc28b8c8426e10c258d9b2bf2613e5fd50f615a65b231d7eeabca09ba92d0d0f8f6e3dab06bd2904ec2dd22fa42484f2bc4ce9d81b96206ecf88162e21f787133a0fe22611e87408a299ae4bc261e1901b8c6be26c192cdb6b88f262326df27d91ee5f85124a3305dc67c7a69aec354f34fd1a2e8f6b3aeb8c3810cdfc64982c3", 0xe5}, {&(0x7f0000000200)="ef5b851dda98376dab2ca2f5cbcbc0f8aa6dfd3749c448aa3d4ffe544fb7c567ce90", 0x22}, {&(0x7f00000002c0)="61e483fc17406bda03fdf49d7ea5ace892c156b82413be99ad7206a2d25d74b8187190b1d2f64bb52f8e64d1ed8776576c5068bcc9e4d2282ff2020dd046c92c529586ae499f9192a3b3c7f5de215158998b220c025a4afb94c7130f2c3e0cfc269191a02e533b57abf1657504e7d76f372e4807", 0x74}], 0x5, &(0x7f0000000240)=[@txtime={{0x18, 0x1, 0x3d, 0x800}}], 0x18}, 0x4008010) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-monitor\x00', 0x513400, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x3b, 0x1, 0x2}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r4, r0) 22:13:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:38 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) 22:13:39 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) 22:13:39 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = timerfd_create(0x5, 0x80000) dup2(r1, r2) 22:13:39 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) [ 1559.042575] binder: 20969:20983 unknown command 0 22:13:39 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0xcc, 0x3, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_STATUS={0x8}, @CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x1ff, 0xffff8000, 0x1000, 0x765]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}, @CTA_SEQ_ADJ_REPLY={0x44, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x90000}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x20}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x999c}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xffffffff}]}, @CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x4c, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x9}, @CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ={0xc, 0x3, 0x1, 0x0, 0xbf6e}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x7f}, @CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x1}, @CTA_PROTOINFO_DCCP_STATE={0x5}, @CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x1f}, @CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ={0xc}, @CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x5}]}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8000}, 0x10) [ 1559.073954] binder: 20969:20983 ioctl c0306201 20000280 returned -22 22:13:39 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) [ 1561.053607] Bluetooth: hci0: command 0x1003 tx timeout [ 1561.059064] Bluetooth: hci0: sending frame failed (-49) [ 1563.133448] Bluetooth: hci0: command 0x1001 tx timeout [ 1563.138897] Bluetooth: hci0: sending frame failed (-49) [ 1565.213374] Bluetooth: hci0: command 0x1009 tx timeout 22:13:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) 22:13:49 executing program 4: syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/sem\x00', 0x0, 0x0) ioctl$TIOCSBRK(r0, 0x5427) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:13:49 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) 22:13:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, 0x0) 22:13:49 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000040)={0x980000, 0x9, 0x2, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x990a66, 0xffffffff, [], @value64=0x100000000}}) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r6, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r5, &(0x7f00000017c0), 0x218, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000000c0)={0x0, 0x0, 0x6}) ioctl$DRM_IOCTL_GEM_FLINK(r4, 0xc008640a, &(0x7f0000000100)={r7, r8}) dup2(r1, r0) 22:13:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) 22:13:49 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280), 0x10) 22:13:49 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) faccessat(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x101, 0x200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="58000000040a00000000000000000020000000000900030073797a31000000001c0008800c00014000000000000000000c00014000000000000000000c0002400000000000000000040004800c0002400000000000000000f56811684cb38a5619c60b04fd56fc8b199b00e257415b884971d2fb1e496de5f77a65046a3b689dcb77ee36a3df3b548bc848b2fa97bf7e48e422152c5e1476bb36c983ae5c9f411c564796ff55c41d77bdd604c904701b29d0908331e2c55501429e9696e131038bff84669833b112db9e782c6dc63d090a697408956a7878f6cfcb71d20056506040403136b653edf6f0e400ef935da0062320f4e8aa9627d8e0c9016b78bc326222f3d1017ccf7328271605ff5087914bd7e70b982a31575fd1"], 0x58}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000b40)={0x0, 0x0, 0x80, 0xffffffffffffffff, 0x0, &(0x7f0000000b00)={0xa00904, 0x8001, [], @string=&(0x7f0000000ac0)}}) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x278, 0x4c000000, 0x0, 0x108, 0x0, 0x108, 0x1e0, 0x1e0, 0x1e0, 0x1e0, 0x1e0, 0x3, 0x0, {[{{@uncond, 0x0, 0xd8, 0x108, 0x0, {}, [@common=@unspec=@state={{0x28, 'state\x00'}}, @common=@unspec=@connlimit={{0x40, 'connlimit\x00'}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_to_bridge\x00', {}, {}, 0x5}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2d8) syz_open_dev$tty20(0xc, 0x4, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000002600)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r4, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) 22:13:49 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r1, 0x406, r2) recvmmsg(r1, &(0x7f000000ac80)=[{{&(0x7f0000000100)=@can, 0x80, &(0x7f0000000880)=[{&(0x7f0000000180)=""/163, 0xa3}, {&(0x7f00000002c0)=""/203, 0xcb}, {&(0x7f0000000240)=""/16, 0x10}, {&(0x7f00000003c0)=""/165, 0xa5}, {&(0x7f0000000480)=""/179, 0xb3}, {&(0x7f0000000540)=""/1, 0x1}, {&(0x7f0000000580)=""/190, 0xbe}, {&(0x7f0000000640)=""/70, 0x46}, {&(0x7f00000006c0)=""/178, 0xb2}, {&(0x7f0000000780)=""/215, 0xd7}], 0xa, &(0x7f0000000940)=""/112, 0x70}, 0x7fff}, {{&(0x7f00000009c0)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000001ec0)=[{&(0x7f0000000a40)=""/69, 0x45}, {&(0x7f0000000ac0)=""/16, 0x10}, {&(0x7f0000000b00)=""/131, 0x83}, {&(0x7f0000000bc0)=""/69, 0x45}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/143, 0x8f}, {&(0x7f0000001d00)=""/158, 0x9e}, {&(0x7f0000001dc0)=""/206, 0xce}], 0x8, &(0x7f0000001f40)=""/4096, 0x1000}, 0x3ff}, {{&(0x7f0000002f40)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000004000)=[{&(0x7f0000002fc0)}, {&(0x7f0000003000)=""/4096, 0x1000}], 0x2, &(0x7f0000004040)=""/122, 0x7a}, 0x7}, {{&(0x7f00000040c0)=@generic, 0x80, &(0x7f00000056c0)=[{&(0x7f0000004140)=""/166, 0xa6}, {&(0x7f0000004200)=""/124, 0x7c}, {&(0x7f0000004280)=""/190, 0xbe}, {&(0x7f0000004340)=""/47, 0x2f}, {&(0x7f0000004380)=""/225, 0xe1}, {&(0x7f0000004480)=""/191, 0xbf}, {&(0x7f0000004540)=""/110, 0x6e}, {&(0x7f00000045c0)=""/123, 0x7b}, {&(0x7f0000004640)=""/4096, 0x1000}, {&(0x7f0000005640)=""/125, 0x7d}], 0xa}, 0x4}, {{0x0, 0x0, &(0x7f00000059c0)=[{&(0x7f0000005780)=""/219, 0xdb}, {&(0x7f0000005880)=""/61, 0x3d}, {&(0x7f00000058c0)=""/133, 0x85}, {&(0x7f0000005980)=""/3, 0x3}], 0x4, &(0x7f0000005a00)=""/39, 0x27}, 0x5}, {{&(0x7f0000005a40)=@tipc=@name, 0x80, &(0x7f0000005cc0)=[{&(0x7f0000005ac0)=""/245, 0xf5}, {&(0x7f0000005bc0)=""/252, 0xfc}], 0x2, &(0x7f0000005d00)=""/239, 0xef}, 0x6}, {{&(0x7f0000005e00)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f0000005f00)=[{&(0x7f0000005e80)=""/50, 0x32}, {&(0x7f0000005ec0)=""/61, 0x3d}], 0x2, &(0x7f0000005f40)=""/193, 0xc1}}, {{&(0x7f0000006040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000006300)=[{&(0x7f00000060c0)=""/143, 0x8f}, {&(0x7f0000006180)=""/147, 0x93}, {&(0x7f0000006240)=""/192, 0xc0}], 0x3, &(0x7f0000006340)=""/141, 0x8d}, 0xc8}, {{&(0x7f0000006400)=@l2, 0x80, &(0x7f0000008a00)=[{&(0x7f0000006480)=""/208, 0xd0}, {&(0x7f0000006580)=""/4096, 0x1000}, {&(0x7f0000007580)=""/49, 0x31}, {&(0x7f00000075c0)=""/78, 0x4e}, {&(0x7f0000007640)=""/4096, 0x1000}, {&(0x7f0000008640)=""/110, 0x6e}, {&(0x7f00000086c0)=""/249, 0xf9}, {&(0x7f00000087c0)=""/177, 0xb1}, {&(0x7f0000008880)=""/245, 0xf5}, {&(0x7f0000008980)=""/125, 0x7d}], 0xa, &(0x7f0000008ac0)=""/176, 0xb0}, 0xa557dada}, {{&(0x7f0000008b80)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000009c40)=[{&(0x7f0000008c00)=""/4096, 0x1000}, {&(0x7f0000009c00)=""/6, 0x6}], 0x2, &(0x7f0000009c80)=""/4096, 0x1000}, 0x3}], 0xa, 0x20, &(0x7f000000af00)={0x0, 0x989680}) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x42, 0xffffffff, 0x2}, 0x10) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00'}, 0x10) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r4, 0x660c) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/tty/ldiscs\x00', 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x80000) dup2(0xffffffffffffffff, r0) [ 1569.293866] binder: 21021:21037 unknown command 1660944384 [ 1569.324067] binder: 21021:21037 ioctl c0306201 20000280 returned -22 22:13:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) 22:13:49 executing program 4: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYRESDEC=0x0], 0x1}}, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000100)="0300ff000000cbe32b0cbd07aa37000000000f0000000000000000000500000000004200000000000000000000d8000000000000000000000000000000000055aa", 0x41, 0x1c0}]) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) 22:13:49 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x2, 0x2, 0xfb, 0x7, 0x30, 0x2, 0x1, 0x7f, 0x1c, 0x2, 0x1, 0x81, 0x45e5}, {0x3, 0x8, 0x20, 0xe5, 0xc1, 0x7, 0x3, 0x7, 0x8, 0x9, 0x20, 0x0, 0x9}, {0x4, 0xfff9, 0x0, 0x2, 0x1, 0x8, 0x6, 0x3, 0x0, 0x7, 0x1, 0x3, 0x1}], 0x7ff}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r3, r3, &(0x7f0000000480), 0xa198) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000815}, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r4, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) getpgrp(r4) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000000)) 22:13:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x10000000) [ 1569.494461] Dev loop4: unable to read RDB block 1 [ 1569.499967] loop4: unable to read partition table [ 1569.506688] loop4: partition table beyond EOD, truncated [ 1569.516456] Dev loop4: unable to read RDB block 1 [ 1569.524478] loop4: unable to read partition table [ 1569.529857] loop4: partition table beyond EOD, truncated [ 1569.537708] loop_reread_partitions: partition scan of loop4 () failed (rc=-5) 22:13:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) [ 1569.649866] Dev loop4: unable to read RDB block 1 [ 1569.655330] loop4: unable to read partition table [ 1569.660686] loop4: partition table beyond EOD, truncated [ 1569.668296] loop_reread_partitions: partition scan of loop4 () failed (rc=-5) 22:13:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) [ 1570.108199] binder: 21082:21086 unknown command 1080229888 [ 1570.114079] binder: 21082:21086 ioctl c0306201 20000280 returned -22 [ 1571.292883] Bluetooth: hci0: command 0x1003 tx timeout [ 1571.298272] Bluetooth: hci0: sending frame failed (-49) [ 1571.612930] Bluetooth: hci1: command 0x1003 tx timeout [ 1571.618323] Bluetooth: hci1: sending frame failed (-49) [ 1573.372766] Bluetooth: hci0: command 0x1001 tx timeout [ 1573.378213] Bluetooth: hci0: sending frame failed (-49) [ 1573.692804] Bluetooth: hci1: command 0x1001 tx timeout [ 1573.698192] Bluetooth: hci1: sending frame failed (-49) [ 1575.452670] Bluetooth: hci0: command 0x1009 tx timeout [ 1575.772632] Bluetooth: hci1: command 0x1009 tx timeout 22:13:59 executing program 5 (fault-call:3 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) 22:13:59 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/cpuinfo\x00', 0x0, 0x0) write$UHID_INPUT(r4, &(0x7f0000000200)={0x8, {"d6c6b9c888c75eb369722bd0790d19b68eb6f599d7d9a45876d5c44c1b689d27e1149618806aea3a1bb97b2e93db095b62cf308be41b7d5df80e5a85f5ca617146da8e8628b725a2c85bc25165e092a3e5016558588c271a2f77143ff616089f278819f38587ebc0550d2b09fcdaaf245dfea58c1db5610b964e798ee0809ea9d683e90eee69cacd60d7a99dce336bb975925c70409b23f14d1570a910e50029115e734307a2d1bb07adce768c6ce2466f6998905e535bd35e1ac53ae0efb2065e422caa513b3846796ce8334b7bfdc546f7da14737185532ca51a04750fa6aa1667e9976a8611a68e228905854dc0ad6d8bacdcb61b5c0c05b1a1bcd868e5ee8c2da8070a2d59487ea6a5768455b27b89d689428bdc28822746aa2a84d01ecfc75aeef6c72886950905a3599462e44496170a5e9640b4c1fe63aaa5624ec042828e8e601d2f687b1de1fcf411ce71060426b35c168c5643669718693dd5c69b14a5c4229ff846a435533871795c278d1cb42d6f45858c2692943fa19dd0f561fe08633616099daba5ca1b824ca96734bfcbad33a7de0b87ea54b27218195fbb15cf231654f108d8c42660ed57bca70c29aa6efdfb72807e6ebb9585c5debd53da7290bd05ce97beec371ab185453528fd0669ab6c072a915c6dfabf05ca5e26951cb5ee66afadcf1f866888019583f3710203e125c68dff59bc5714c1ac97a60f58c1e83a8a95e4958687d5bd669fc3186cd0121770bafbee0523d0c0beda3d1751f4bc43a8d49c15674aa18204ee149ab4639c2e68589fe2b77f3144d9d8dfbe14b1866c7831dac322e69e88df9d76835636afc9290348893ed48f773bfa47ccbdee3b23753fc0b592679277578b5452093e9bfc4450bc79f99f53da178409a1b2ccadd930c0a7e00ec3d27da62c57312f934851936795baff50104cad1aae0e4d51d6eacc81d4e3aca51752aabc45bc7a287ca27b0c3850d86557045f5ccf94439ef485e732d58b99c5915f75031b527ffeae7366da2e0c66c6fb3224ee0bace714581437d58a69050ac9f27183d4b8f28df58a8aa1fae48f2f786d01be9452e4450b84f68194ad2833e481a3f3070fa7e8203c955df4ff5ac168c4706dfe054417214e50b73468d7386f4bbe842135f265672dc9fc0141306bc0b129ae047b844cce233f0ee6c26bbc047e0487466b6bf068a1c985378b65dfbf066dce29a42b5e41dc237181ee2fb458e42ab7841e560079184bf867075fbcec62952653ae40ff05c383d959c11d5334b6bf5c1b20ac1063ee8df1be0b8ab325203de9afe5c08fb177ba0e8477b6f461dfbdb31ed4c2a96863400fe76bfb16e3ec1946d0ea809dc774e81f418b884adfb42ced7883c1b2e47a110ec469ca3a626254d70224b5b514b710117ff928e812a49959add7591abc3720bfbfde1b7822e2512c99a3dc08e1e693626521457d8635150ee83fc1e1417d0474f05042adf8c33ff7cd7a9f65edefd3544a2b1a0c47adf9996a046ff0832978e213a162963e39aae4193eeae1cc17da991b87a9b86c55341d1f067f667195b03f67a31a807db116aa969e2d532af237ae1abd133a9d25a631e696753e76b2971e608712ff7517bf68ced512124422ede80dce52013ff050aac10712dd2e6d1b22bc11404e970e8f9f1b2fd2337ddc1f67b5e1f2283c05beb46c061c6f58da7b0298c34b466c9cda0580dbc2fdccdea201c57ad38d8d3a786d98da281c990bc5a5993b2bdc25f739358e2b506f8c143ab9eed22c9db7098eac0831b8fd07a81ea6cb7f493934c0be4767fb29300589b8f4a26b8433cacc9f96e913cb59aa5df2cbb33e869d81e691e4a22cddb56728afd9008a15d40d6ec65a494d794dd854c90161b0f1153e6b9c05455219c804bbfe034b19ac2b88afbd7e9d0bccdf6b56b8d57daab622256e14c86f044c8aeb681645ec90d6fe0121a41eba3e864d8fc0502bad747e7bff0d93a4372bad978cc669cc8738c0814b339be19dc13b793f0d1eee293e3912b2699f54254654e0006d7c02e527ce45cd9c95d50a86203ad5476156f31ac1b12faad3e85998645e4c7b4cfdf1c777a42a97535e23d6db3c1618d609082437bff02361cb1cd9da2ddf1de51f67b68e5f93e45354563b3cb35e1a06f9c4798652bef5f33e92c8c06975c1b6a31d8273aa18f274dd1b29a492934698a0609e816820e41370806ab193cd937d34573c896652aed40a6764dfc12f78367443cbc478366245c87fff038e05e86649fa899804bad7c449dd9f6dd5ff257abde16791ce0edadb57227a13adc6ffb91ef6c3283d583a7cfd0830e68d07efdd07962f3ecfc1411872995aa3743d63159b57c780c528f8a6fda9a61b31c005a97c6ee9cefebbf518b42088a207901aa63a76d3f6a668e786bf5ba5acc675b1ace3a6ffa74cf6e4472c7338da4b2d0cf57c1406545ed7d5dbba7eced6da10e49aad8403c6ecbbeaff223335e8205f0300e4d85a2677b040ce22d32fb7089bfb40a130a705266d22836f84296eb9907d82bbdab7a2c2577caa5f44af381844f1c34e6668c8e047f3f7f4b9de27707036475e1a332b0fa29851ab4aa9864b9f9338166f8218ae5e8be36335b7d46cd66a31254770687c82c40e4df937fd0a36248f32c843c3ccc4791f2c4406cf725eb71a1d29669a5c9bae71c56beed3be0bb8ca6c5d7d61a924e91e1f29e5e64db5b7c9dd91ab034b3d889b62c012a87cc90764764b49ddbf31c4feec50c36f20ecbf08f4961a1557ad7974b6c0ec680e5e49f024e42cf61b157caff6c3a72f972e8cf799747dfea96d9b03026afa86690b7e38a3f19382536c6a7a12e62c6563a179b021e54484122056cc9de46faf282d7ef22922126dd8e05094f4692810b87517fe25c9feedd3c203f78ef5a4644300f1d476d59c68d16c2b6403f8a80d849391eeb415de0df3779b511bca941a3e894740508351f31b3304646e8525d7666885b29fcdfee2ac93b2e03a9e716b3286dc63f69ecdc326727502a116baa173cbedc7acb43ceedcbe39563b56e99862b9f7577abbabceba40ae1ef22f1c81a15288ec21a8e6e4b357f8f3868408a715c5eb2c0da9562439ad82511a62c3a0ad642f505f00e44d9897f50edb8bbd986e46677cea5b27e9243289d09730d49a2e0d1767e7e80c6a4e569279b726a93437870b948dc8b24cbfea860e9c5c0e6fc3cc20198f6b7258ab4c136823b9015e25684af61f0bb3424008380bec2586773f43d4b868fd19b8d5bf670ff09915ee866922fba424714be4b70a2f6bc6cfef9150f66ee97c2afa40a748e5e3d2ce831d682d3e72b8dccbc8dd76be8551b3b57a41892c18aaa9c8a35c0127379d3c2d7362a927e347d32450ce162164630d2bfbb009973eae40901aa31dd547504fd2e6648f3b2e157c1c36cfb62d0f197e5a0999005672ade7bb7152925a699cb66821348a9e5ca4c195423f3b5c293e58747d7ff710737e11d3a6febcd04b525fcdd6d2f36118a3c3b11211b62253e15a30f7266084a650f68385d2a34e3b850392a5e7d884c56449b68f3775b2a29d0cf6eaef51e92538ccfd8a4886e9ceae058a38ca319765d848318a704affb9e728224ae4703f8c39200bf0b97ceeccd88d95d58933f99d95f334ce516f5dd297c9ad1d1260bb7021231ab87fbb0c9a654c39fb10889a5f7cff7e67ab225acc1037322497194f23b73cefeb1fa913a2f401dce2f834b34e2a1882a9f3f1f69060aef4a38a60cef0e235a6e753c6a51608c7512ced847f6dda1712fd460721cdef5dd366775244510c226f93d120d2f8a434bce351d951d9c3a103ee75b700df8e731dd1a6e72a6c5a866d29f41f76fa9aa98bfb5ae3eeae414237451c015de705f3d299c399a0155491a0704b68f2783c7abde9ef7edb3f511fb0c434f1967e5806a5e42dd3fa2cac49fd0e872bfb36ab4522bcd51b5f927c5c05aa0d99a14b914eb3ef671a90974926e0c8807e268a76809768b2615a9bb323453d7989141fa073bba3ecf11ae1aaff418b60cb27847bcc003429a7ed84226ee2053f8e5769a9d40f061c291805d1d5aaca7a134614cd6e5d9a6e8d385ad7f97cf7232b9639296b401fb7b09cb067e3ed421003e18fa54e345dc58605f3622d195ef183316be5f859a1225b6dfc98d557b9452bebf39b727b3c93b6c5fc2ed8eb4d0a90a624ac59aefe6c7df1fc828c445ff09cef9e1bbce67f7acecb72407ed63c3f1584d908c5a53b04f1219cefd15cda63f148ad36d8d93628ffc8b59271c86f2679780cf7968456ea45f089260c9003568f5b3235c028da6fcc309eee418b3c4ae454398f20c2a2b4e68fdea44f030367dee5f3aa5f2585e3c833335bfa38f27fa2d208e4a777bdc93708ab9137a817e1c8c499233318a27b71b67f2b608e7900126dc59172b6f08612cc265020f82b8c295c066e340cda37b38ef14e025f1a1579cc2d3cf0b9420bad19727be2ea357412f76fc6bf40ca52b04d31a39cb13eb26dd57958526b46be81f626167de69919fe1e97b71ff3692abdbae9fb163c02dca0f8fc2ace961256e3d97c391dc30af71e329a25883ca63220cc1c1405353850e72c4f4c105f71df48bfada7e6652902e52c8ca15af192c0835ffbb301cea3e284be370b0a3e50896d51d4d801059990f9721c40b37ad52f3c1fb42a29fb06ba576eeaa65291cec19a398a245b6b805cc0deeee31a1b1c85a295d020dc951f05c4c5eae77cf8e91e83de87c5fc6a845a711b0e82a291673ca47659ca41fbdd0977471da0c8184576759d62c8286f16a4fc49190ab32e8c0ce5a5488356cb05c52e74ee55212474f4c84bd8172fcbdf993c0443add4586ca46649cd95c01f63bf883297e282622dbb6d92f731e5281209d9f25145598794eeac061995f98226277068c86cc7250f9243c28cbfa6e1b71622b4c56a8868059f8f3db176b515e7358d585c0666a7f357ced034ff0147453b3276d29d806e24f8e43c21dbc04457ad34501185fafb14ee2d7ff8d10bbb14cece775aaa8647d2074e6980acc34f102a361d1e76efb1e6522138a2416f89eca2a9f58aa68cd10c9d8c0c7909fa97aa95e09ae7b488561f0ea73f84a17db7f8104d71fcc2c0b320e8e63970f98d6b91fdd27d12a506f87cad2c2d9d665b45526c64aa7cddc8a28712a6138ba45465b9faf835d839cd56e2739bc34a97865a32e4aa211f4d7aa6073c27fca7d250214a816c44e8eb259122a3ac12da053ed8012b842155cafa25de9e71ecbd58bf5e2925779f83c3fc4a0da7bad257398d240f4f8477d6fc79a25dc32134118f1ec1f731e24ff1b624ca74b3b901b89360eb89fa2cfc1e1b4730faa4a40074d1b040f9b311abcf2509c72ca6ef0b529ec15a5d56cbcc0831786426d2a8177b0e0d0d97b4c7caa22841999eb5e0cba39d70cd462e5cd142a7b396e3071e3d4ca776a7d9d3cff8429a05feb1545c3ab45f6f249a90c16d3b41a61a16a36ea2f38670209a7ccf857d0701113c8e3abb1171fe27fc8a6fefbec51fdb28b8cde157c76161ffa9db4e50ce6f9764224b3138e70fd4c27ad9e718f355e9db85086be3262da65ff6aa95089c4563c58b1aafc2a33dd47cbb9c7bc78a7c8ccdc61905dd1c011ce17972a1c21de2409c543cd4b5e6c8d602256e91a936f18856f34d0355ad0493ea3dc372ccf820ed97260ef94c405afd5b333526fdc50e906edafc879778b3c4ab112cc3dea17d75eb67379c3159f9c249d3a562f129ac9eb5d8ac08a04c21e781cebe9338d0", 0x1000}}, 0x1006) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000000)=0x6, 0x4) 22:13:59 executing program 1 (fault-call:2 fault-nth:0): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:59 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000854a537793089a14df018bbcf4c5e47b52c541f08207c790155009584443e07d8f0a05a910025233df97c6445f4f28f644baeac3e8cc6ac98e98a36174b0e6e247498aa3a166f7579c3eaf55656db824381af41edad19720470ca5ae1c33f3799556c6c3ad53c886525033debb8707bf871e5c09161488ce29a4bddb428865b5837aba8bef098189773f01f7", @ANYRES16=r3, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r2, &(0x7f00000017c0), 0x218, 0x0) getsockopt$netlink(r2, 0x10e, 0x2, &(0x7f0000000000)=""/149, &(0x7f00000000c0)=0x95) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r1, r0) 22:13:59 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000080)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="0e"}) r3 = socket$inet6(0xa, 0x3, 0x80000000000004) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xd, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000063404001"], 0x46, 0x0, 0x0}) 22:13:59 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) [ 1579.462714] FAULT_INJECTION: forcing a failure. [ 1579.462714] name failslab, interval 1, probability 0, space 0, times 0 [ 1579.508583] CPU: 1 PID: 21106 Comm: syz-executor.5 Not tainted 4.19.118-syzkaller #0 [ 1579.516497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1579.525857] Call Trace: [ 1579.528463] dump_stack+0x188/0x20d [ 1579.533411] should_fail.cold+0xa/0x1b [ 1579.537314] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1579.542432] ? __lock_acquire+0x6ee/0x49c0 [ 1579.546673] ? avc_has_perm_noaudit+0x33d/0x520 [ 1579.551340] __should_failslab+0x115/0x180 [ 1579.555565] should_failslab+0x5/0xf [ 1579.559264] kmem_cache_alloc_node+0x55/0x730 [ 1579.563759] ? lock_acquire+0x170/0x400 [ 1579.567718] ? tty_ldisc_ref_wait+0x22/0x80 [ 1579.572034] __alloc_skb+0xba/0x5b0 [ 1579.575648] ? skb_trim+0x180/0x180 [ 1579.579258] ? ldsem_wake+0x40/0x40 [ 1579.582873] bcsp_recv+0x913/0x1420 [ 1579.586501] hci_uart_tty_receive+0x21d/0x520 [ 1579.590980] ? hci_uart_write_work+0x6f0/0x6f0 [ 1579.595563] tty_ioctl+0xe0a/0x1420 [ 1579.599187] ? tty_vhangup+0x30/0x30 [ 1579.602886] ? mark_held_locks+0xf0/0xf0 [ 1579.606941] ? proc_fail_nth_write+0x95/0x1d0 [ 1579.611418] ? proc_cwd_link+0x1d0/0x1d0 [ 1579.615471] ? tty_vhangup+0x30/0x30 [ 1579.619170] do_vfs_ioctl+0xcda/0x12e0 [ 1579.623044] ? selinux_file_ioctl+0x46c/0x5d0 [ 1579.627523] ? selinux_file_ioctl+0x125/0x5d0 [ 1579.632016] ? check_preemption_disabled+0x41/0x280 [ 1579.637017] ? ioctl_preallocate+0x200/0x200 [ 1579.641412] ? selinux_file_mprotect+0x600/0x600 [ 1579.646169] ? __fget+0x340/0x510 [ 1579.649608] ? iterate_fd+0x350/0x350 [ 1579.653401] ? security_file_ioctl+0x6c/0xb0 [ 1579.657807] ksys_ioctl+0x9b/0xc0 [ 1579.661247] __x64_sys_ioctl+0x6f/0xb0 [ 1579.665125] ? lockdep_hardirqs_on+0x40b/0x5d0 [ 1579.669694] do_syscall_64+0xf9/0x620 [ 1579.673484] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1579.678656] RIP: 0033:0x45c829 [ 1579.681849] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1579.701688] RSP: 002b:00007f8a97584c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 22:13:59 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000000000000f", @ANYRES16=r2, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000200)={0x2, 0xa, 0x607, 0x0, 0x1000, 0x6, &(0x7f00000002c0)="31f093738d29621ad4d4f1edb96a89e24f5faaf474aacbc735e74f73a6e4d8bc503036207c44ff1795eff7dee6eb6ddfe081ed98c261d052c5494dde17af4d75b4c972ec6c58db8588a1ce5b9d729d8a51379317c71ba9379fb2bfb03b5d1af3112b36bc0c27159c739eabbee10cf3b79d3e5fa5ecd66572185290105743d852156c90a35ec1450ff314881e6ad240fb23dc7d84f7a11b659541075f47c3c1fac5bfddeb2092182bd0ab3fabfc1579bcbd076189ec793306a201f5a010acea248f48bd7b5394e6b611394383dc2373dee8d5889af882a4e1a018464a2889e2d388a7ae26e3a013bf538119093e6cd9d69a1f87780121cb2d5be692eaa63fc450e8309e1db2a0383a7454d5b01f442b0e33c4dcba888a859ec2ff7c0e28275f1872bb5cf7cc5713037a0bae35a931ce51c199e4f4f4454078eda4279eb8e1fb572bf772def912abcb661ec0555bf769dc2d7bd5c6a2a3cdb075406708606f98e1cf3902e74909486132e79378332b086626d5c4ef87e062a77fc83f3cff9012eb89802e744c31b5defb943de827f14705718fc35deadf02dff47d98469db6ac523a80ba5e4f2140127c1785a39a19f5b290d291ac3bb5fd746c5c0006a326882848138653ce16f1ef724a4be1199743425a7f8cbeb84a7478a5c055f10b68b4287b0a6a5797ebab33e9441d86e55a7ab71ae3b50a2f3908659e8f35087b9f87864b6ea1c3c463197a0ca86e4b00000a84384814478d6dc8106cb4a0494b9ed0000f83f0f0d8cff8f51d7727f66c4934368b2d910a3ea06eb77d5deaa46d90389c68322f4471436ca49b42cde11e7c63ffc8f7c333092b35e2a09ffa0c4607819bccc0ef63ef04bda184662d2172ea52e740792e779215d17d49825b395c0be759965cf6403386f7f79777a726276c6ff26d7619f1d61d837b28487355977567fbcfe37c30b6c6648b81c3d836b83b41fd8acd98817af959e0c43cc7c001b50c06dec68e9dd450517012181ae21296de2667a7b8722a34890942025ba225f1ea58aeea23ea80fe5a688d2edfbfc44b64d805f98f61f9b2514174f0a3654aa6544077f8ced69c4864d910dd3b321ef45b448dadf78e3df76abc7b01497ff8eb259acdf5c468db7323da49b0377d6dbe7cb9d5981de9727cb1980e63c150804f1cbddd395475ab5260c239976629114667d2bbefaa31663c71c78b2e2d7321e2cc4c30671476d44165aa36764f1a507116b460a87a78ed74a380a101745549d103c5a39c71facfa6194b89f8b8046a2b5ca9f37a50ea8574ffe59cbe16600723c49beae055130381e8ea99e99dcf4c01519477a4aa1ed38377dacbe9cb39a5501c10378cb5e28bc25b8cc757b4faeb0a1b32dca2b5167e36f7d13952541972258267a7961c04a3e013849e7feb82946cf65be872480eca83de4ee525747d76719e9f58bf57df8339c5cd58fa943e7e3f58e41209a5098b9abcd13511e4df58a71da4571300c6a52ee6dd07c6e362173b2d7f1a59b47db250ecc99b9fa243e621e7f8c440efb5d51db09add2ce9a6abfb0737a0934484aeb3b7fe526e9fe2c998ccb2405db36f9580b67e6ffa7a2e742c66049445aea1e39d52d15ed7c09bb82172263851995347e56ac0f7c8f8e19e7e088ef235a6b09b3e5d97a9749d2595a2c7c5db22bfc12ef1199b276aa034dc6b228d92ad135f3e3964888a94f6e4d6ce9d1e54660799239124fb40f90a3d23f7385c89650448f85c40a40e23911105d364b28fd2e2e99c752e8e48e0797c86e217f0ddc087f222275c3bcd11d582f8fb68c53f65a2fed42e0f5f12be5c2cb8b76f286df141d2d8dd198a0920ba96f38b4637aaa1a7795add0bcee94ff3f67637cd854b10852bfb2e3828e0626809530194dc6a3e44347c0db979f77a5f668f4bfaedf153a2e867265e258b8091334dff3b7f306f69e1cc138cc7dc8da0bdd724dd595f38ebf167ff3c3280b979721999c633fa58ad8a1507779c8196542d5a35db48be563a0bcff97d7924b9197831bb3be5c847aa5202fb00972e109dae6bfc7583b4865325fea0b9a5c955ddc116a8b753f5a624e7a0a4e39bffd9af4755ed83fdc6cfdff40ec612c5fdb44e540f27bcdcf9fb60d3ee11a8ca9dc628fc3c627c572cdfbc685e9c5aca4c5e41809f4b7d02d033d48b740a12f6256ae12184498fdf6ae98376824b08db49ddf7027dd4c8a6b523d3cd953369e1e2be1aa6a00fbe22d960b725af51ae45213d69661bf89e751b6815290b0eb2d6a8cbe4fd75495d7c4eb24c0eb75a5c9e9f6bf8d5d82dea52ad493226222df3b71f20be1073a5e44d89d579f57b88e4c1d8c06cf964f5c8356c60ff91204ddc43f8631b91ad4719e18daed660db01d0123b23d93b4f412e9f88ae0b0f297f945aa50e60c47339f2dc790ccb5905b9f95205cdf3664738aeb6e168f5e8a5b51e299f438352ee7dad4c98a3480784f3764272bf756868c713bc4e5f2226da79870a8ef596edd217b5af11a0abfb114ca8523e3aebbd9f04275779eba1eb5a78378234ec921decc2d810b0e39213c5d8939c8a1b4eb7f02167e4467283a707a74749d4531b1bfab631520bb96bcb29d5d8770473cf207904c14df5bc4a549bdde0f7269ab9f04833e97c36a35a3751684a80e87e4dddf8de0f9ce1f1b1203dc7ba6e5cfc98b08d47565743ee1b0b033bb7fdd7d9b6b29bb9dd8eef304fd3d28657ce11cbb7e330327a1445f28bfabf5876bca5616c6e924123831fd2e2526d947bc78d9a8a6986492f1ff32b97733588a51fdb3741adc4afb8234ce2ed976c9280d6dfa68bca8b25910eefcd595ce8e2e79ee219b59decb5b1a7a5452e5d0ffc8ff8d9c7edcf9d440fd212896bf22057f2acc3a86ec8a80dfd7df7bbf2adf611e3d763dbe857ba1587dcdecd119f8b131d00d812aea9c5a415cdb6d4cb33b7a87392763a63a4a5731f2eb42567916d196d44fe22a82a42b6922a4d6c8c59ddd2a0753d2d700c83f65ced2cb224a8f1f6a82d56671b593bc636b9af0a2ecf41635e6feac9a0d22688be7a866567346c46a2034b54fe168555ed0b7a17bbb03f6c1d99bbf28056c15adcb6efa756ff2581cc780b7a31d2dccea7957c5b1b9708722e1f878a5ee2b8efbe72366be09aacc9321a3385706396709cdc682651b9a12940c43f9a47b553a8fd41f9c5d76920515459964c9ff0bf535afe6eee5e7aaac525e002fdaa62e505963f557ba6095edf0fca1bb3023c11cbe398801e999472b4b298ba236de1019bea7689c214f866f063e9a55642308f68cb6945d4b6b755a93cbd445b659c2772f0ad71fedc50262debe651eba2cc6cb82f6e8ed74c410af523fc3a940f7a42f766a3caf8679da68624deb029ea1010aa4ed5d9ce9d7e202879dd1ae984071b14d7e69d411df4a8d400e98b398190f38e6d05ec090c6fdbb48f7657666ff8ccb6a8f9c5e6e3e58618e4210d8a12fa5b82a7d17339fbf2dd0578f213c56b7a06c54bdd38d7926dff52f2169dd56757c1c88c9f64e88c1e6167378f16cb36feaaecc8dfcb833154f55826179ef64ce36e3037ec724899a9f0772065254d2fcf233a68a0f0f9e81dd22182cb416f6c3da40989b61138cd139ddaa79d64a61c888640ebd7c31792cf1d17d38dcffbd03191b9be36597759818ae7c6438f3021cd552177ba369f319e993c481fd7f9f95151d91a95f3a05ceb4db525c4ad3fbb40107c8b42f8faca6c98fda1e7a4a85cb88840745d5fbda55eae895d87ba9881a42598872ca3eb6d28923e2951f0c8934aac30e18dba6975d49d1b667723eede260413bd212b539b7a8948f88d99ff91b2af5fe1f5665140c0b7268e224f7e9696f0b770d38397e1ede88632cf592e1ea7413c7ffae867a7d3d15ec2dde03ea78ee07f421205cc1cf964036b83e415e1bb5498f843f7873470c112f2e1091e4d0e3d4ae62694c948be2bbcf02be057200b9ecacfe5fb0c91f09000410a56a051252d627bbf22f1d27addd0f4da23d50ab2f9221d53fd14d133f85ddc132717b023da8efbb7fc30e07ad3df405d902e21e121af20e5a99419db63bf1d4a1d825cde57e8186f1099a9bbca5c804178b07bcc0cf3140c60918f3c214b955b0b128a5d5372b7fe2074b50c4f127202ddfcc8100df101cc0059a2c3d2cffc6dad5565babd9cde538c96ba9b028802b863c5ba4adf33824bf97895a570ad453322a979d4aa1603abedcdefe646db043e4b398ea7413e8d4aa22016021561634cb8dd363abb18221d3c055b4fa8d1474d1761ce9b1d4d842f1b123bf8adf47ac2ea540dae72fc92bd29da6cba89a534ff6c1c19a891e51c595f8fbb25c3a4ae03f14cd126d1e9a808bc8d7990438217dfdfbef812edb902e0a7af1034e114600ba559d3b49fc202e8d72e69c68c1f757a0974fb1f53117b6e0095dad1f1f34466aabffe441b8a5010de91b2ebfde58a5fb989bf00e7e09e29a7dead479571f9e4e89439020df7cbd823f360ac54f5d86557db431b1711a910767af540f316550133ffca1d3284ac386b31f73cff1aefd367a7a7b794d731d1f3e8810750274db0f71e05cac76a767a46c3e42ea31294e9db7f6101141f746269932c9e70a363bed6ccdeb33fc86b30361049a9413fb354154b27e26b9da6dd86b1daf86a0f496a3cf587d2afda6faf83b78dc441a68214c27b07bc0d53f1f80f699a24e117c7837d02b2096002b89ff1417da4abf573073210f3136350e4907063614bee0660f71d874cd89230cc07acc4a874374c9845208715274d9805f96f0c9f2ad87e007e995683396a3a380f374853058de21f25bdcacb9d0feb6f4b1d6f8242ec3fefe1ff0bafed62639fc01b7a588a18894c1dbaf24733242a4bc8edf52759093008007c08ff1da912c9a54157f4c91f3473e53054e0eccd526a55cc850d5bfb1d640c55c385fe9fac46426b9da34c63d068c56073eb12bedc76d70bd5000679386e9ffb65ddb574cc1d94d61ea07bb0e3a541bb9fddeca541956b89d9d31c783dad60aa7a06e47f49f03374404cdc816cc8ac30f740670631266827185cfd7286d9a4bd3c4fb1d310ffdfc6fe50e000e55513bc0caaf448ee4d5bc0084492060f422be5694aae2c866d2096ccb2091c36547759ec236a26165fe81ae7bc5669b20f82992e368723df552fd4dcc628d00c7e6c9bb2ff141e8694989ff36e17a93be611718ff19d87b8f32bd99700c6c5031ecf9ff81d9ca76543476f2bae3a9f7995f2768da6e6f5271323f657bbb3787eab12757827532f2481c93b1b28e6bc649b1ea52f99fb761e6349e77f700b40867c1e9615c46ddf3ed6ee2018e539be5db551599a76f90989b59aca6c8155fb529ec57b3f80f4c61ddc940ecc5e949206e4d94085bd10715179019d8115d3376710140751329abcb01be41cf6479d04ce1dbfcb36c208d27cab6c2c0c4600100670b4241f3e64d047736873f29dc08463a42ce09bbfe9bcb31f836b0ab285d2b96457760d4bb54bd363f4d170c51d1965a1906de1bed24495c6e39fa7acfdfcebc6d1fda0eb43da14d865996e00a740988ffc6f4ebc6017d72586d91c971a0d1c43182165a354ed6b49648f3be2efcc25fb3c57ecd1afcc736cef0b18a0e68637beb6798bb5f47ffa21832f9682933178fd4469f8b1928e6733b8128e21b5c8dc8a58e871cca9e6e56a81b869c25c4a30677c29450227d17ffff26979a2fdc30a7a7043a0cd9a245551a28ff1c58b8503521bce7b5d2a078fc31deb03957ec805eb152e20728b63dba746"}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000020", @ANYRES16=r4, @ANYBLOB="04002bbd7000fbdbdf251d0000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r3, &(0x7f00000017c0), 0x218, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x50000041, 0x2}, 0x60) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) dup2(r5, r0) [ 1579.709391] RAX: ffffffffffffffda RBX: 00000000004eebc0 RCX: 000000000045c829 [ 1579.716646] RDX: 0000000020000000 RSI: 0000000000005412 RDI: 0000000000000003 [ 1579.723899] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1579.731161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 1579.738508] R13: 0000000000000584 R14: 00000000004c8192 R15: 00007f8a975856d4 22:13:59 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000000c0)=0x13) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x3c}}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x3, 0x0) fcntl$dupfd(r4, 0x406, r5) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000080)={'wg0\x00', r8}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5603}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r12}]}, 0x3c}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004900)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0xe0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}, 0x1c, &(0x7f0000000040), 0x0, &(0x7f0000000100)=[@dstopts={{0x98, 0x29, 0x37, {0x73, 0xf, [], [@hao={0xc9, 0x10, @ipv4={[], [], @rand_addr=0x64010100}}, @ra={0x5, 0x2, 0x1}, @enc_lim={0x4, 0x1, 0x1e}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @generic={0xa7, 0x54, "cde7e7d80c88baf761964dc3ca4d9f26629f2fee4495232c5b7e693a14a0c47721d2e72fc9928e1f946a96c1c92194efd18a09d627df4c8ac25494fedef9a7ec5c189e0c9de567c77ee572ed5d7c8d56c7beda51"}, @enc_lim={0x4, 0x1, 0x81}, @pad1, @ra={0x5, 0x2, 0xff}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@private1={0xfc, 0x1, [], 0x1}, r3}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0xff}}, @rthdr={{0x38, 0x29, 0x39, {0xb6578c0217f17928, 0x4, 0x1, 0x2, 0x0, [@mcast2, @loopback]}}}, @pktinfo={{0x24, 0x29, 0x32, {@mcast1}}}, @rthdr={{0x38, 0x29, 0x39, {0x89, 0x4, 0x1, 0xba, 0x0, [@private2={0xfc, 0x2, [], 0x1}, @private0]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x8}}, @dstopts_2292={{0x28, 0x29, 0x4, {0xff, 0x1, [], [@calipso={0x7, 0x8, {0x0, 0x0, 0x7f, 0xffc0}}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x1000}}, @pktinfo={{0x24, 0x29, 0x32, {@mcast2, r9}}}], 0x1f0}}, {{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000000300)="7db1498d5d8a2a0c1b33319b7823", 0xe}, {&(0x7f0000000340)="94079190639259351b8b58078419101bf4feb4cb337258ea2fb69afdfbbd3c94515971f5b9ae7824c8b1eda29d7b9797cfdb47cdb4e7183efa0a88f9bb5ca32a7ed297a3e88e4907088dc861ca076fc5052994685b81bf57daea6a1edd635dcf13820b321b5f5cd037c03665906844717db637cc0262b3bd398cee851779b8a93bba9332dd93c78666439923f3fff2a0c578ebf1417b180c286881e605760791b0e9330ef815ab5e7682ad260b641ba6e9f216a47ebf1f09eec2a64196a87a391f1173624c4da669b34e410d19bdeb9027f2d7cb49abcf55b1269cf9f6d98ec62ac72c465609093878e981de45b4aac8ddc1ca4c459fe494f751bec8e9927780df411766ae8879a175cd61063e0a3803f74eea5472a1b7894a34757a4cb87ebfbc2ed6661e0af88ab6381d794817a0294cbe606459c86435aebfbc3e5e233f77fb035aebd05945221eeb8019bf98a52747d997e79058226847a8147305d47edb869f93eec840686b10ec6730f9204f09a4090deeea019e77ad1bd07ac4d41d19b4e96770fa9862fd43260c7fb8e4cc34511ae9ec5fec4fe768dad23c3a7c26407b4f2ff3f1e7cff1663b21b6d1de3484c5cb912a6742fd08f352e1190e2c6c8915109408579e9861bdb27ba81911a70057ba6a173496f84f81568dcfce7fa0d8834aeb8406b946e41fe245e825f3d00fa2d9388ba3ef7fc357c905da7fbe25c8404f6dada0459c2d8db08ed56091881bd022df2f37a26940cef7b89785353c8f83d5c6bdb0a2cc50f671d511ec249b4bc17b4b104b1d919073f8eff66e51797791a0fc243a1cc2135fdf7ce0136da0f0c18861e515dd757853ba64a3dac23b3a2ed96afb79e98e3ef3a0af998d16ef73d93a6bc661202b9821aaea62ed35b5a06315ffc79c632566289abd6df65c6cedf4fcb71b5712d75c07cc1fc8db5c0f4a07e9bed27aa9f35774313b9c43a9412c690fb78a75b13fa9dbd05afe1a2fae4707d1fead8ac31235c82ab87282539de9404cdc966b0b5cd2edab389322d2bae3bbebec47aafc1d5e931b7981cfc12066516e3b2dff1ec56f4ca0c84b5e2c8581f9d6e731a04e4df64504ef103e9a640eba56f3ec6dbf4e8bf033f2247edacba82d43842c7ddd0c1c8e1005d25471c564825aa0106880f87d77926bcbeb7aebc512edc2a11955560a7af5d634aa191956385bed42c41eb0b9651ea765728aed8032d8ef0f6d8f7eeb46b5c1a3ae13c63388192ddc9d3073d973691bfc520bd5aca1b0a08ad059abe1d13f24327a8e5e015fc37a59900199d425e5d91c9135d467f04ee787759c35f54888e5de60818357249fd04f2b9d113bff89a44171c285c7ccfcfd80cbde1c4f964200531f6938525115bfe9af283ac05099a57c47a06c51d3a7bcd62fcd089ff9fa2bf078ee070cfea5d84c34f9e385396557b3fdf6019bb680622d15ce0f2cab6e579a2a93b04a4c8b004f749e574148271efe3caa23791e4f5f4b8a06200c3e6bdb0b3626db2362975ab8c3752d8e731cdfd452f54948ae6ddfa6caaf641760bd7a90bebb8a8d9f4b7865919918add37fcf55f3cfe259a5a6098e87614c3e69f3f307f7fba6bea2110826b2d6cf4de3fe4c46d8eaa24a094fd6de7f6a81694a487b0720ed569628ecc0eca862ea1ed9c0359384f405f0a25ce7b4755215f8b4a2c5ed89322695f05234fd64eb1589afac2bc0a19cbbb2308e9b4938badc05dcaf23325761355e0238c25ea0f6763ef981a5ee89d50a9b6851dc5c4cd58e635b0e069bd9b38d614e8ac213e9062a106c18c3074c87390ef5bd7753f5275057b775019b5d3f226aaa6e0bd8de5478ebfc056d71c9d8dbb81c4b388a1287d4206b0099a052da9363c6fbe6ca56e6d80eb876fffedef109960e4edf05b4e0d4c1a9ed9dae95725c9ab7e99bdec5901eb1b82908d9bd433c8364867d19b4de8f5db1c3900df058de9db09992764ed5ec3d715b1871e2c2a3d301263e8504bef35e5de8d0a1b89e4e25a5aa603f5e78e8f9fbb61366820cb36984ea8dda41fe6d6513b0f5dfac9d4b3d4c909eacd3260b7a165b08387777b2586edf61a28de3d65b3f7150d9d368d044cc5e6b387aac934f6ef7ab753d2d0ed60fa3c393b84cd8477d1eb3207ce7d7695fe2aa6c5ee5a9b448352a97d1ad1a7eb0361238b01ffc729851f72488d0de5daec60ca3f0076350e15cb7735ee207ef67a8eed6b6faa30f2dfd598ddb022b2ccddc34e7b24d4725b9117de041bf2b670a82d115985e86d109e36677ece6fd083ce69a13fe98660e2601a09ba4970e121b1917b1add4bcc92010c4326c6d8e890f65d5f1b80b20d885cfc1cdb714d2fdec10e41d7c6fe12aa94d674e97bee5056b5cdf02fb324c677b3cbc239702e6fc9284512aeec39048b67547d2210c9a52b5fd4f1e7459ac40e5e306e8af8ff7f0e4551e250d2064756d0963ff331e35546a760614785c30b95a8cb829c476b2d994a23ceba2fb15de97e9ffcc6293c436c3cf8f6bf6a36bb108b2b1371482d879c5469720bf73de5d560e22b3c9f7420bd0e4347723c6a8ac1fc41199c044820eec490f455dcc0d4000048e0ed493410a2729078fcd2c399d90d3ebe362e59d937da93980bc40b1a333bfac5693ce207af2cd96ba1cc36ff2eacdeab3fe26f4f3c6b33a8f3b4ff01e83289cfedbc702b98026f2f50525c0b9cf8d828d0b4725aad447efe8788c2b8cd81e7013a74b7898f8d3db3a03557d9aa1a84b463fa155f4544a6193e3d0f3f65419eb5295f39d9de62e6216ba0c744972bf4f04155e90fed9321603fd03b75d0376f0f6418e2ca78a76cc6cfbf95dd6d0857b45c2d7f1377aa8fc0ad36cbb8da22b2d70c7139b5884f4e19b638af41094ab4f81d815fd492051aad16a63097f62fd925dd55fc0240a64f36b47cbedf4b95e479a2b7b4fb1ea3286c15bf922e81d709ee50191894e6d578189f2f01c7b38ab79cb3ce26a50adeabdc0dba574b6bb44f368cb394ffc762816976666f4fad85d577d03ae4dd0b0040646da19360744e1f17383dd83a3b9d3572a979fa0d17a3a9bfae0e3b769616efda8f0a934eeb6291a5d903774f387082ea236c0b1e49d56ffb2d2d2b2831bcae973998a26877d071f372c3daa91dbee5e602c4ade1af7f5b490e9a306b8b7fedf0feb76d6945936f2bb72a4e79f63af24ce0f1edb3d2dc543a70a138b19b76e9348dbdd24062338d41304a8dd5c935aabf73c20d436ca5f4ec573ae102edcd51ed05ff3d3ab86dc7e718d7268b2466f701e2b16a4ef6268e641edcc50a47a288a008bab405bfe1c5e7ab860d0ba27f147ff1d8cb37c74d599625bb46a1df1a942248507ceb4653778dc5f01182e203d56b46347577c686c7c07eba3b314430d48d50a45c34b08fa11217546b91db4e47c290d83c556cc567bb2b706ec70ecc919b4f7a4dfa0d50949708e21edde9369fecad52946c5c1a20c7d422dcbf29cc089ebe3e863e5a449ac9381f34da550b1850636087c115468bb1e5d21307045157e9ab01c68614394f39058eb5c86dfa9f4e535ab2fa622dbc4fe03984fbce653989d5b3aaab45c9ed9eaf382ac84ec92a8979e5977c5af6e7e13b4599c31a7f5ed8ec83017284fb6b1e3b8104cf75c3fecd9ddd33d466ad6e093cf1d7141e55c736d21e374a865525e27cf1974da1b469585fae98211e179622052a9974b6323fb1a6cd91955a7a2466076f60cef11d345a6af7a186360b5b850f25c4a387fca0ec0176dc6b979fbca5167abc7bd7937788fa0f8397da94f943c9dc5f7a4503ba5d7232f6be3c66a3b7d43405459c86e530ba51320174c4fd48552f9719ac95029d96f49e00209b50bd8b7912a411ab357f051d8e23b42fcc7b041cec3feaa56f85f1f6d10c1f345db3ffbe1c4ea449c40163a50ede39cdf8fd4730f55bef5dc52e58e6a99e6d03d395435788bd6c515f6ce5d0c1f470a5b51acbda605c74ed6064221c5e1f5cdcea6aa505eea781f065619d8a64a0f1d04469b87bec803f53c4fd750b368967c5d925238b7bdd4f0092b838bfd20a26da8fa693b5b322c48ae8f71631ff0a549b58c66c82f062ba50e1b383b400fe4b5f567b90e8625e9c430a3a49a83259f3fde2746c35a0f90a8efe839d7bc5c2821603db71eb75042e60337043be054379908ca4d9c6d7f1f95973bc363d6abdfb85fcd9631ae5e46030b92d91274c8864fc42b34876b2791d720048d20c7c6496f85bcf67b6aa66e4f638862351523eb36541d3df6fbec78e2268005e2e4c3dc176ef79345e852b0b45d5138ba1af1c3ece54f1ef560eee827f3a6270fd52f5b89ddbb7b82016a28964e00d9b6c1f1c491b7eed29f0a4b5679d3dc3d4b9ed6355d89ed04cb81cf2f8d9ea1073641088da311949f87e445a8ade92284837f5a8b72405b95eb8773a42888a686bd36b27c414692edece7df1fbef1462dcadbe49f14c8c941bf6460ad21929ce36852695f9a66d920c95b7d8228b0098078d7c990752072f763349bf4ed1c5d0a1d4b64c27b80870dd192926b887b8932eebdf235b1fb281df734b8e24391b2a79c7d2c5382ffc0438d3e9d6f1948b141532bd7283b07151d91d1a4a65ce6e11cfae78040443ad724a243281fa5c8f2295b6f92cd3bcb90bb02eea03db488fea3344dc7894752eb3ad49a411a1e0869f64bdb323d13c06ba21767fbb83851cd1671efd8391094b5720dac4384dbee3f51b299fd34c0596730a06308f5ad7132fbaa5b5fc97b39c8e9e6906c14cbceb4db572324a46c33e508aedca33b8400ceb0ee1d662ac9ab95910d765e38b91e570493dd7dbdd892f24f93f2af2df5c53367f2acd0b26eba721aa0a9dc7fb478ac758ab2618663e10261df925e72be77885934e16e45ed0773aaae21098cfe189fe9083dedd26a75eac36804beda1a17edec51de633beb3e62f04cfd605df05fc9ede8ac62e149e9b9cfc9b22761a0bdec4cc478ca1706624dd978a0624d964520b8d95710a2a081f2f5dbf2850e23ddcd2e0aafa72bd506182d28820d35d4ef4c6179e02d80e914e91ce932e04425b1e17c6a146181023ff5f20d3ef9d3d83ddeeedd373847bfcd8b30ddb31b92e764507567d6843388de965e2c8ddceb1b2d7615e06e38773773cc0dd1384020711c066ef549e7108abb51da699cc4ca2f2b27dd861e78ef0784271792789ff487baf80dc584a10f74c664925ade482801d2037e06c8e12e3b5cbe3e9b70d96a1e557fe2b693400597f8808945243a0c5ce0fc0bd98e6ce186489d5e3122c53114a49f5d1fbbba2e18fd63d6aa48247dcc6045b8c8367e7703b47f2155acab81f08d43313f510bfd482209822a47345012a93e65238d083f387859b10d13954f69f34f3d043d198b23288ec3886e5d0d8aac0fbbebfce55827fd230f62e16451c68697e9dfa533af80aa57765b86a1fa8cd7f334a7423c9c88175c86c4b2e556b9b95ad8d65e777d8296f12d7405d3c05bda8dabe4f9a3bffe1999984cccca907319d0ab63a8f77fc922aea1a812525f28da13514a2786fad1f55e69426454fd1bfd4199cd5e588984bdf634c4d5fd7ae3c70caaa6c2b96268dcf705f562d4f59a34ceadda65925d670345a5ce0784a538d230d706da37ac387c002f66e860bf0d2b91eb2940b9358c1bdaabd5905b7f506ca9323a9d7892c10b4cf6c85a751a43ffc8376498e8ed3176ce1fcb312c5ff99d02cde4a0d86fde4a83e81589baf3c89a03724692d3f646ab2208d2179f936809dc587bf20f83010debf7c8464877", 0x1000}, {&(0x7f0000001340)="609a4f38d09689ee6f0cc23e55b08f747f9541877c99397a212983e842b87923b8ad715a42ffd6f0d52726ff7b9bd9723330e60117ff748ccd20fa14f79e2808985b8b2479c51647c21a5a019f80c07b4a8b9028e194b23f97d38956781109567e66aba88839c6e76ca83c372d3afaec1fd005a5175610eed3e8df68e4de333c73802bf64240fe3a2392d14eef231049ae1b12ddc9d0341116", 0x99}, {&(0x7f0000001400)="f5c23e412620edeac2688a5769cb2bb390ea34081709a130c1bab4336c237485e23a48796fb7dcac", 0x28}, {&(0x7f0000001440)="9da7d5118377ec467ece0045c62449f0b56a8fa59c4ab47880b96024a570675fd4c90d5096", 0x25}, {&(0x7f0000001480)="a6dc01b373593fe40a542a9849b4370766fc133521288064e4963fecc414d76a30619718c63b8416ab431cb8442fe2f3c1b3d1a13ecf9fa3bca4695dd4fbebf6df4745b6b192bb5987fee8bc75696eeb1777714971253f8e38143b7d079fa3ade4f49540e34c77e826a9a37fabc82517a95befbf40a88bec299b1d7583e34f043efec0a24831a0964cab1e8d92f1e694d2c27e478327ae483e62d9bca0c3bf6cdf206c24eaf45bda9787ef5c61c109f3bcac561392a6ec7ed5b928306f50d0d5908b4da6e8", 0xc5}, {&(0x7f0000001580)="f39acd2028cf8d2bced675612bb47eb0e9f74120ee68a946f32032703e14c9502a9309a9061dabbaf4583493a22e278e958472134ad41ce44f869398d1deed678f3bb26e10a34265b0cf1cbbe80075198fdfe486189920e13aa1998cc7e234cd5bacf0b50607149fa294fa7f06f7b25336777548173ecce5c1a554a9101d19238cd12e23519d95ee6925d919acf83ddd615a16884fde724b43926981cd73332b85005b84f52d173d0e7e43cd107ad66558336ce2d45c5899973e9d763bd9e2050e521e06b73c5d", 0xc7}, {&(0x7f0000001680)="6f1be54707906b73d21e082dca59c803a87f5f829c3a165e5cedb33fecc8053bab919db00ba29cb2e1f1fbe282853d473d7ff527592c15a8427fa9805a2754f636f62f22829f339bd6054d62c9794b9edb1b7981c56d84d1d7aa05cd9ce6ba734b28b27f130474bd6457992a2ef569106b115d736239a473939b090d135d0a6f747e5a3a6844d15a6665fefad84b7dba714c7ca2b4a885b254696852e29a50f17e45792107d17431bd732cf24d926ea3d9c0a34fe867bec61d1193cbb64c9e22cafa19777deeec9922c53a25623ccb6bd84c73ebdc47328cf35f3c86e6d94857c78ba94ed717c1c5ec1f99", 0xeb}, {&(0x7f0000001780)="9fa5970a09959182a974ebb011b74f1a4d68e0dc46db7c9eaa77b0f301a2333cba02a121ada0a08f8f543048877718e1d1394c19a59f10d44f52dc648d57ecd1bd9a7b8fde1599", 0x47}, {&(0x7f0000001800)="328dba21f92be12d067d28811483c8331dc663f884982514997e28cfb8cf4b522968f634f79c3bc9e65f4327ca03cf5d8e786ec53a7b062697361d0e59ab8b6419c619a31deaa2c023feb849f137f2cda403ebdae3a3e958165d3a12015cdf9f7b8e358b26a621f21c9c01fb539e9fc7d343d21298d5bb8262bc5a437232647edbc491d8ad41eaa2367cefcbde7eeb30da68e6b0b006d332ba9bd906df0c299e0832687c8b120ce826c14ce8056b2717120bf95d68207be1e38f6dde1b33c3b27af327ad6c3bdb99259d02bbe8c7fa1ebd02eedd9d10bfa211f0fa5ffe0970d99a029097919d62931b4d19eb7e02eaa5dc7f26fac35c733aba198cd8ca96d5abd6d192a494fb5000678b0ab47bf165b82106e913bb906a7ea442570a8722d6e739d502c16c4083952f7ec5306024431d703196c18ebf9fe34946e1df62e0612c4b41b75a8d3fb6b2b835e729b1f55d6c5615a89b295b32df3f1925117607e0354c4d844602379a1f4f467fbcb135f8b6a4c8f1ff057145fd0e951ec768d86f7772d9106ef9524807aa153b6d47e6efc9d675eebfcd165155b393f0510482f27fcbe375fa0ebb7647b115d6424bb0678f04062d41c708cd7d35a36401918b1e7b807b5ddbf8b812f9275db075af90648126a7e57440dadeb55ac9edea23a68d173050cea52a3c32899c2b68774eeaa2929ed527f2d35c083ae08e39f532b08edd0519060dd30bb33bc6646764ef8b5bc2ca709e2aec33a1e70b71219b372466506932be382d09f94a5bea1dd4a8319987da3a7836fd264324b6dd1e66c0f0787365f8a9aea25ff9ecfdeee5f2b3b1333d91d899a42c4ad93241964b805bfe348ff91037a2c70a89395d689a39953e3afefbaf4608df284c339e7715388bfc87211f9bfde89b403b2b5c51bde9ca3835feefe09e4aeaff79e03ec7249418d24b098ff0180caa6fd675546bdde189f7509683b7be589ef7148da5eb28d89e2a4fe21d3a9254e7e8fbe91a369fb89f3053f2be538ef6b0b33a74b582a022a8140f3f45b77f93b62b7d15324994cb690fd7678017017fabfd6eed25753148847789aac50651b305e0452ffc2d773f615ac7a0e9fe776e2d4eed97cb34428397b23ed5b5f21e0a65c7cdc6850d2c09623143245357105c49ecab0b3a554a1cdd180b34896ad109d360ba5e72d0c89c68aa9555f28cf26c0b169ab3068ac6af88895d0a0f237d2da07c4b41be4c4bc672c0b65696e323f33331892d7bb573215c6b2574d3fe70b24962bd7bb264a8765cce1af853b55c8ba83b2484713e301fca2c658140a63b2b8aa1b1321625f0d58a763ea11f388c4268dc4f168e797d54e96a2c9ce307fec090381763d324a8d90d96e0f4ab0f3997c52ce50a7f38fd08900fa8c5cbcfc18748f9bbe58af1f0e70998dee6b434764da9088130a9229b984e5b8ea34bf6110f3b22452003fcb77df8eb078eb1f34819bcd25e7ad3602e08ca80d5481b46d96f26404714f47baaf214fc34647d9b665ee5447d278f72f850b0f049747421fc3a987c764836a3cc980680aba90ab15da566db9b9aedacc6fb4df6889b6ef899c678be5260186eefb53be34b277aad4d6961416356b2dfe782ead9101f89551c50fc2c7be41899891c53f6f2ffaf4b346ed98d877458d1ca6866d5417ff0fc64ffeaa22822735730e4d1fd6af65ad94b677564d3f3c861a64cd3bf0638b157da534df115ac7f28b312922468274c2910dde8dc6cb5dbe95c33d695b7ff8fa9f8d5d80158415b3d22c840c50d97a5691aac86c2daf9adae8609b954a16ed6cd4120bd807ed59c870424909ef1125b094eaf074fafea0b2bd456a748ce25c843472f01b7bc78b07219ce391e72949ba93c8a2260b5fd97949e5207243c7a1bfc2e1d89625aaf71243d615f8857ca8b76a1a838076a9cbe68eb5010902b71b05c646285ab0b97c865eb275514977199e666c61465561d945bf1876879b9001998b8b3312e08e863dfe94ab42efd637799b1653da837b63962b567355e2b7b6a805507ce93ebf945216e3312fc2a330be2696f1685562ead3906b86e2e077919d706ebe3c1a5913f1427180c8a159d1bd54a0d85d61f9161f24a0f7db8983b26bddc5a40a6581e19845fb902f08d0bb5ec34a011fd86ca7f8c5decf5a6474d3ee094a44d38f4f01e9d84107ff8f5c0a6630fa9fd0c970c4e19dbed8ebc3ad51959cadfe81eb3830fb305e2ed883d7a3401db0d5ce7c13cb1ae7aa9dee1e33d635d308583de463fee877ca7eae50af0ae924ad8250a9303d20cbd8bbcee2ba2c09d86dccb7d276d9876e5e43c171edc64f8752035e426def8f76eb6a82b5db2b773558c075c7a4a993e4d06839cdd379b80f79df8ae56985b5b30993afda2728574d449e2b4f06e5906fbbce7e107352cc726bce36a2ed9a60b1cbb2a9b97992ca4a8e22e69e56e9c9cef429cb95681276741682d47175871269612f11daa9ff23726473a01bb372aeb0e9d056fb847875b2cb5e7c71bb0efe3ecc68e44707e0719ec1f43391ff921b0712ee95f9ca1268a480a08212bbd51c4ea58cf8630a71781b75d9a12b91635022b6d11f7e487ff2937b3bb54d38f6c6be7db78a588cd232cd7b40eb4291d79d377bb6eec7989a77e09b7475dd7f3ee759036fc8c53e1beefb30758a3e02f8ad6314d29ae0087ac0f4d8d2c7b6733986dcc8d2d0b3de720ac2877d8f15cd65011c5a7d41abff85cf4fd78edbc5a11df3891552abf16f934c99e8000525ec7bc98bd8f2291c72ee8261c0c514c50aed645570c4c1352b8919029ac67ee01f63f913271cfc10c307f926bbd4784867ac98e2357bc56b9701adf1b729735307b385a704a41ee812138a39d63ef71b7f59ae05244fb30eb22c8dc62fb49d3c160d25e17ffc2b9787b61718902a59967cc322869df5df0d9b5782d752bcbaeb36bd179ddf6e3e5234c7d628f3c34b9a31b087f11a926aa330a45db8477591373ec13cc24e9cc06b03dba58cde8b1947ea9a9d6bf6c61b539b8693b2257ef3c4ef5917286102ef24dfa44ce98b014efb02e4866c4c00964831ae176ee35abdffe76e69d50b9156a8571e8fcb9845e9a2e0e85cbbaa389b75823568c79815633fb49995be07c3a34b0c58b7ea2c38b945631d47a247a7d4d3488cb6e02e78978b9e925bb2994246bf0b7b006b15e908dccfaedad47da9d2c73c4a4d51f731ac2ce20b91794a7f49a8e55f1117d1321edce8bd768f3aa48e36106950ded7f17e0df11fc969c3a25036517e9ef99466577ad676bee19419a5a53a4200a53b76b8a070469216a0698b472001db996a273e3072492678bcf138d841583a3a9c93deff1ce06171c1619def1bb6571906b3f75c463d0ff92b32d3c84b857a6781021d08d9f591b05a9cbfe576042b1462b781bf9a0ba7bca55965f99647bfc2b33c3cd06e63074d3d6b7eeec8344182aa98a7e6f6be2ce79c85e9d38a99dc0b0c83988b7a7e2fd87298f0341ffa15f44c1df2d27e9be2a92dc088e166eb53f86fb676bc3e10805c74d287ed5e19719fb2f63f1ab5257f148569f61521063d87d8950ed641d0bb3541bf55d25cfb8a14d0d2f74d4ae594a6cbf660b93c21e8f927d6680b58b2494f8153c1012492db21a3ecb688eb65753a2e94d77bbf7a8139b0035666eecf99e60e902a68ad2368cc79b3bf205d1928c79275c52258cdf382c2dd8a35e3f7e03b2ccbd94afbdb92106983af5e58bae595b18470400b997c86cd93e00d596c1e7ff556da5b8e529e0a81da9899dc0c7c2fa6399a5b4cf8eb8dd11d92b87ca199771ad3bb9ac17c70a385fec67e90e65421ef980ebf8315ec89084bcfe6b833807b745ce0fdbf2016ba8615cb731617ea169e9dfc9bbaa3bc4b634fe2d23b85c443ac1ce55885b3c4def9aeb189a0c47ccc6d1b2ac98b658854ea70e616892f0a7ab5ec125d23b0c1c5ddc237ffbeae9c657ded34d817b5c3223a3412bbd6d0a39c6a7f417d11f40c1531e11bcb18a05480e76637198deb8309aa4b78552b37280e7c6543d2f6cfd5a722c8e02615c994079fd16766a2fa856ffe25d0a13bee927346ec1eaa7169d5c4c4e1ba62f35a872aefbb01f9b45caa7a01e791a07e1214b94801cad1ceaa9310fd151eb684184db2999afc04ad8ef7d9714a7b18d06e232c893170ba5d189245a50f4e14f1932a566853bbfcf30ba70d3764edd35f026825937d872a65ea2ef33cff981613c82cbbbe58153c73298797bca32ea578b7c844a35e7362afe5c81ef2e4ff7cddd33269ad12068ba04576781b367f1fecb811ba37ebf9e30dccf822ed9267ecd4b6169700afcf9ce70fbbde49664db27dde770efe7e1144d22dba0f402d168157c979c16ce350a85865ec7bcbb8ad59dba90cd9637f439522ff7b35ffd9563d7a9a5bbd78728a64e92457be3c319f3206c0fee5c6e5a3c4623d0f5632f5631b86c0855e69b7a55adc6a630dab2cfd03153caa187ea0cc268c8f8e4e66c8707d15e34c434e1f8d8a4c5fe44324438c0d861dfe5c42b403a938165b718d307ac8320935c5925e53c98850ab65133f45221cd1ce572241aea7d8951c1090e6c3369e449819ba03cd82c3e260fc872d0cf1723238220288b3a39f11241962553cfaa1f4e77e7e4da9b06b9b63a92c95ad7c2e775a4d4d58bcd7f810e8fc66e1a50ff640e9f152369b8cf8ea45f06ebd79101055218af3f19d7eccfdca31e414d963ca57f5159cfb09dbf88e791d4f230f42071c0d25de523bd65c2d44e61a7d325e1e586569e48e48df0aab5465a6e5ffef6c851501999acfbe15bafa258074215de093267cc2fbcdbb7a256f399a45a149fc3a5cffcdab24b74ee87f94eec6f815b369cd817eb5ca4a020f892899df1dabb43df1c8b881f2744a21f7070c047991c71a258e2daa2aa693bd7659976de1a6b6c47c7ca1b108c5335e156056dd92488c93fcbe12243b6304730f1e0822973158b2fde02b74e58c3d56f36e11a5e38109cfe4d1bd0e8d513286eaa563ed6e1d68c52160bfef0806d8fdd118b87aba9f0f58cdb2a0f955afd3af2e206154b4f4026e667d6ed950f16727dd82fff6c38cd84d00efe3192e00a8549576e502ba521b929ca864105db9b1b09d7c024eafed253985ba37e4ddec2bd2a5502c998d2f063002ad45ee71469bf2ce41f80ec2d4a5731c25b15937a6cdd189438bde269f3c67a224eae4409fe92434af66b0d6f90365fbb9d32e538d1d3b543b5d8c10d3beb0332100c25aed498d457901e00c98461feb7a4b32f6dba891e03348ab467062c60fec73d17e8ce3a313b94f0a8978673c12e634470bd52f966bc09d43d0b78526ac7b6ede5ac7e282c165e678afad24a4f63bffb8ff21ec119a17a19da369af081c3785b0a7c5678e0877d5deb59026ae8ab3cf03b880577462f447fd9cc770ddbff0045fa12e44efbfbf17249b5348aa7820813c5c14d3d81464bffcf845cf106f1368a6bcbd21cc6e07cc220d6c56f3011ae61dc0b9451559ba11bfbade547f86c302f4bcd5fd04cf0c31c1a9836ff02154d3e16b7a30e1f32d0f612ed329d70e10174ed7f4a488136d586531f0f7217d4f1fe4b0491e524173d265f2de15108bca0c1f04bfaa52216ea89fda3f2c242a27af599155889de2fc5f01df791d5b2175050ae10c96a2c760b769f937039932d2e8318ce8a242ecae0ee05475a2b43be091590e4abdaf3b4a878559941142b82b3129186cc77bab5b35041463db166dbebdf22d4953e328a62c1b3f6a83c49649e1b0674b72e", 0x1000}], 0xa, &(0x7f00000028c0)=[@rthdrdstopts={{0x88, 0x29, 0x37, {0x16, 0xd, [], [@hao={0xc9, 0x10, @ipv4={[], [], @broadcast}}, @enc_lim={0x4, 0x1, 0x3}, @jumbo={0xc2, 0x4, 0x4}, @jumbo={0xc2, 0x4, 0x80000001}, @generic={0x8, 0x40, "6368aa39566b8996bd736260aa38e0215a3e22c11f5f7ef441c61d1f53a4f76317863c109ee1499b7263e0224cc4eca27223237cc589480751b353060f6c5bbe"}, @jumbo]}}}, @rthdrdstopts={{0x78, 0x29, 0x37, {0x87, 0xb, [], [@calipso={0x7, 0x28, {0x3, 0x8, 0x8, 0xfffe, [0x801, 0x4, 0x6, 0x0]}}, @pad1, @pad1, @jumbo={0xc2, 0x4, 0x7}, @padn={0x1, 0x1, [0x0]}, @jumbo={0xc2, 0x4, 0x1}, @ra={0x5, 0x2, 0xd99}, @padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x10, {0x0, 0x2, 0x20, 0x7, [0x899]}}]}}}, @flowinfo={{0x14}}, @hopopts={{0x80, 0x29, 0x36, {0x3c, 0xc, [], [@calipso={0x7, 0x50, {0x1, 0x12, 0x9, 0x1, [0x9, 0x8, 0xfff, 0x7ff, 0x401, 0x3, 0xfffffffffffff800, 0x3, 0x5]}}, @enc_lim={0x4, 0x1, 0x7}, @hao={0xc9, 0x10, @remote}]}}}], 0x198}}, {{&(0x7f0000002a80)={0xa, 0x4e24, 0x7ff, @loopback, 0x2}, 0x1c, &(0x7f0000002e00)=[{&(0x7f0000002ac0)="2a9e430915b8a890c628a5c9498a4ab05eee7c3be1d2d0a31db77dcc9bb6f7d4c8447a0aada6614cc2c22c4c27e7c1e1a1a760fc183cfa7d71236876d76e96034da4c64fc4a0e5669e6fecc8a59b6aab67334e01c18bd178f4e2f87e5f2813cb741db1a8d8f0e5094aeb00f2026e3975355e0038d40b797ae6dddb86bcff835515be41f91b91", 0x86}, {&(0x7f0000002b80)="39551719ad12f4", 0x7}, {&(0x7f0000002bc0)="c2a04f05bea599821a6315626f18d4ea870df00671be4ce027771dfd86e6ac4b951b40e8867688a2e03a4808da7708328a0e7753c6e8c13127ee19effcd0943bf2abac9b5a54b95b3d2b16478a294dddb4aa99f3b6356994ba838ef9ddb2496070ed4e290d4682ab881bb6aa7dd84c4e76736a31df8333a13b8ebdf10d3cdeef854f53690f6bb208c89edec87c3ac0af3032890e1a07bbd2844052e4d44ec6a1f26173f093ff890faadbe5ce8e2d3ec5055eaef3d33a936863a13182d7dfccbfacae05034e10d8c558513b59dd0dc8dd86e1e2e6109bb50158fc5469dae89370559f3b076b455a8ae13b9de09c5658aac524767e", 0xf4}, {&(0x7f0000002cc0)="a265cec45036a81bcead54d9ae53e30a1da34443cef944ea7a23a31253b02db82dd81267a9035ea0d616fce629430fd443ba0f97b8ba6b22d371c79cb99433b1774292426d03ff568b8d78156a3fdde9243c2ac39e5dfa8047585afa6f3368819c2657", 0x63}, {&(0x7f0000002d40)="ee5d3cbd4803844e9711dc21d2e55c6801e837bf066b0711ee3771f9ebd317c82665b6d407f8b0781c110c61a1ac5ec0581193094bf88fd21afacc55a6fc910ae24fd7d8ea55", 0x46}, {&(0x7f0000002dc0)="a970d559ef3b4d46b96d94f02cfb6828f8c01a7b640a72654d18ee2213af7362e39b58ddf3b8ad7522d5d4", 0x2b}], 0x6}}, {{&(0x7f0000002e80)={0xa, 0x4e22, 0x0, @private0, 0x9}, 0x1c, &(0x7f0000004400)=[{&(0x7f0000002ec0)="fb0188ca2e72a6b2c9fc7f8244b754c3011ff4f0c105d97ad364c79edb6e", 0x1e}, {&(0x7f0000002f00)="3a404dc2cfd3c23faeee352c92ec3caf758b479226368d0026331d201048ae06e1ef732f10c64528480ded186c5aa77c4116a0710e373342169882c24150a61f651f727933003de93cb8569bee43", 0x4e}, {&(0x7f0000002f80)="b815cdeb9cff3cba89101ad9e449ad4e75439a7739533ecf6b42144d7d52ffeef17e9a9118ab41f3ae8ed059efc54b5abf983a4d39fa7b91a92f5594043fb5e752e38b7637f86bed87bb58c0048172dd0bc8b2c063f46352cdee97a7295ae31a", 0x60}, {&(0x7f0000003000)="d480dcd026e2e2beb4c38c5953f332a6031f2915ce01f58b65a82527ce66027c7f7e40edab1827787bba364867cd8dbf9b9dc3eff3c877f9c0550091ec9487543e1d8297988badc009bdb371f5f22f8429697bab563ba66a9b1b199852895026882825fe988cfbfd0a19cd1f958626fd947e33e169001cb19065e8ea0e4d35ceb9f202e309e46446c3317f1efadeb403147405f7934c409e90efa580cdb9027c96d64480b836fc411612e7f9fc10e5cdfac3ae67e5bde7b0f1efe02fd7918517de3148eaf78ad764e7be45efb983252f11d4aaeeaff6aee55ce667dab5999c815e8a63bd19efa4b09ced5e", 0xeb}, {&(0x7f0000003100)="bb65289c8f1263337618947d4c85f72ba2da8ee136d9c0bbcfd6ce", 0x1b}, {&(0x7f0000003140)="eb2b28795ccd6bb0e8ee08487588cb840acc0f44b265c0d6748f59061e6ef31db7a180fc49d4243d7fb6fb765054a48bdab0f9362f71f6b32a410f306655452c8c55bd80145898e7a20af1fad9f8dfc6216954121f81466e6403b1c93f6f7f6f2f1c0006c8970bc1ea50588601c87280a5994e3f7f318d270a9b207f50ae61e972d97ca7756bbbff638c281c9b86339e13ea9fbadd8f486abf3128af09233ddfc01b7bd24f5915f36eee638f2d53c15c8543a30b0387c3d49a03def7f99ff6c21f4bc095dd", 0xc5}, {&(0x7f0000003240)="f7e5a244bf8f3b86055af533664416c18632b8ef350206ccf92713cf829b74a075708b92f48496bef13ae8a60128d94a9b744e4ffcde2b9bfb3ac61a13e120054502cf1c5421671eb669c5ba91070e5f5e76bf61373ad42544a3065d7dade05280a3e4ee0a5d23db6f9a2df634414012c53a0ebb7bd1c78196a362b99a24d5488019d8b759c0386066ce409101f029be", 0x90}, {&(0x7f0000003300)="a5be655233b9540f58314997156f598f167164974dd531987f850985b6da11c8d4403710d94d3258e9dc422081ef8195e1d550404e7efa2dbac5f703538a104c32d94ef82990426ec823583a9ea6659cc3ca22bc8f68114104fa7557ae7f6aeb6da8fb7257e2ab41378a36692dd5b7b46e5de28a051054197a87df0764755b2b66753eae3564ba5e09a86b3ca90dc6d049deda83d486fba4aaa6c61c2cd772b2a1a5db7d92cfd607e26ab08fbe0883253f3edd0e022c8051a44b5ccc178f1d67b7db9a1021a1dc98d68e3cf5be550d5c1b489f1589bfe12564e7e16afa41245481db699749f62b005593c354a3463b53a339c857bead397df09bd0fd95034fefa71f8985248c8f479c5e6da011add1cd3e2e89ea5c00c898c2bdf2200ba4c95fae8564824fef562de154aa47056cd6881829e5c2eb8a4669885bd2f54bc2ffb1fb361b7dcca33b7a42135ddea65d7c0b262bb9151992e5558e4a69c79ea1582edb334a92ebab68180a9c063642fed7f0ed351a7b18f031ebc068185d73c9f537041dbfccfdde8cfc8fe643de6bf09e77c6eca9ddc22004743b98f0d6fbdb3676da6d1cba44ef02cef403bbb98b1a3a01e0f5673703d673e20b6a2e842ac2e67b1edf35a02d4ded162fc9a6edc3fc326126461620167b960fff1ba4fd7bf00efd921e4e6c0eb1d3b0a7005b82e06bccb7480572288883ded2017d6c0ef018948a4f81656352f8745391d2bbd64397d36c44c886a73c8d5149d9a46dccff886d33047902af2eff062516709e44a0af89b86a0ca93ff2ea1c4d612394bc0c407b9204eaf067598fec0004ac301b76649bb70bbb6f7be49be3cd7b333d1ca82b2621ca8b7dedcf6da13d87d7e17f37f8306f9f40cb98681c44e89e1421bc1154c7ab312446f4c94b481ac70389994df55ed60c555d0d4af80b46c187ea96697c3dd15115e4d26d048fcc9794d38e7c6077fa41fc29ac22553106c8695b6a39f506a7a9db67be1aaf17ab6d42d45b5ae17655d9016a3ab08267679d0ed10b631f2898d765f54c85d0d9a0b86b574e0b42c058dc6da223f20a557d576d1c8859521d6e5c238304f85f8bc13cb10d2b16743dd4c92d906790d34a199fee9ed36560fe8a47ded8a748182628d815992b210de4897ba48e8b6f0f246b0df7da9886c4030a94d4a3f2361dea71e12577380247931ecbcd42ae14930cdd9bd4aac51fc55442d79441930773e3802ce8d44fca7af8654f5476daed970664fb7af8ed230157def404c21a87bf4a253c485b2629e7dcdfd516e7327e10b4d0759af9d55b4da75a0d28d22ab186724e5a1f6590f4e58863fc0a2bfe64535a1d16015c7230d48f532d8b8f14588b6e3ba2cf9f9e6810e6f3ddc45780ae4b9ad713859f472550187b7299cd67183c7ff64ee0ed3cfc0197ee858042b76c89441539a841522941b99bc5f827e612f4d849801327a7a29354fd63c45b86da6b42972c6a3637edfdef5bb4fecdbdb57ee979e246dc62d098c225d15dffee23df2825447d12151c300a76a8ca109d3d42c0cc6b6879bb03537c4b1006fc2b7614efebef4d33685097d2e3a0303095a789e69eb057aaed5df332990a5d3b7e2159bdbc2499b4d4d737adfdde5104a4daf4bd1cd499bf989cacb9c2ea9d44b504a30cab48d1046867a579e1cac57d41c16b10b87ca6b66f39f605b2157ca3b6c59553ee81973b0ebb1b0752ef7af8fa6b0691e1f5f880946a60432f94f823f7319c740c50c48cb0f22fbc181823b820cbf76662db9d1eed3d842625d0d0a7175f2483407d387757b939d3e8046a53b0bbfb56dcaa0d36bdb3a03bfa97eea44a3c44faa1b3dc7d609da93afdd8cb827535f116afd900c690196452c95d1e397d401de58788b3513f81f830998ac6a984bffc7fe0909bcb1d57dd88e6e34aed02a792bf173988f0d20e20c1d96f930af48a01d62b9dfc794adc8d6c9c103098c168f2a2868c4f2b104e5b7d7977e3058496478295d1bdc5d6e1bcc129a16cdd73b4ff5fca13af31455da0b74d968d8f7ad2ee15edd1c00907b0fac445ae0c7492d4ce49ac8d276bd6358e39dc475710ab2aa9157fd756e60688b38056a76554e591716b8c5bede5a495c23f38335713aab67bc1b054abebb698cf0f912eff5636317fc7dcfcd4727a3be4de344da3fa589dd273dd5fe3c86b3c419dcff32f68b70316196ddd0680679242f469852703fcd6aa7f9d70537ae571849c17c1304b31c1d0c92a347948ebe032dfc5622a8651babf13336776f04d4119e7b61acc7d160e0312b989d1eef55f11784edf0b3100f680dc402b61309366621e259dcb1ae560cc980295d3336647cce9209bddee4d3f526b84cd69b1fca810804ed777d12863bf6dc612e4d3e207ec3369f4b2091ab575cbca338d6b3599d9ebc85492b9058fc1da043b05285a9f83dd6575dfa11c1bbb6cf9043814c8c96727433a83d53104e76539198c2abe3e35b15ea8ab0a2fd94f8e3f251a8681514f842ad5770c174ec3270a825914525b11b0d957ac4117a141384482b344ac714096f4b1f159c0eef1c1f4759bf1848644948c4aeb29d4be95f70e655e9aeac7d6718862a91e34984ab7cf61fd046c152e9cb53b7a5116282732a4c75367856f0758b0950942e6763d00916cdfcda9871401ec206d7d391164e0bcc6c08fa1969b0b103c83556d44f1228f1ca8c1cd3ca060f7f0204050d6767c72025c644dca9995463fd45b2e6a25d9f4381ea833f4d9aa0b1581fb9025e3a0fe62de012bbf90d217b3e2b4b1ad758d0553235f79565ab35b5c5e87440765ed7700b44f05e80b1fee950ea10a0ebe41f9482f49632447e19f263f076c79877c36f7df630b7bff5f53cb851fbe2e381aa1ef5760e322089d1ab865f2de0663b0f8cb8c61c44d1f565fe6cb3f15e5eaeec56bed89793aaa1dde4bc19d846a0370984a5ca27938069a3bf19ed0bb46292153fc4a0230ad070ea5df7553d5af5afb0b7b4db39c3c24bfcbb491b18296f0032f793acda2694e3ca5549062dfb9e91a5f75344a0aea24e4f51b8925814f2ad1bdc2462722e38a05913740802c18c48f93e3978e3352d8b822273c520220a0a0b0eb4b47457faa5ff871c62515ee7e59416a286ce94cdc90c5d893970a94389d29d050d3613c37deb122e4e2ab328ab5b86683b6c5dc748050267643e711a068834b341a96d1d12cbacc845be05c7a420f62f92bf174a596b816f8686b2be64d8f1bcbc16af7af685305d4a0d433fa034d2e5a8cf9bd0dd1f1ad716a81a0e067ecfdf3e600472b85cc3e88e85ad052e4f3fe80b653e061ee576121f3a16bcf3d8a24751be0afe96543e7fcceaa0bd468476e82cc537f3231e31deb8da298d7657d658f9f0eadecfe1777f5a852c4ce3585e2bde63ee30042ed97ad5150d17add90fb67b8d14e7eb02ee0455de3164739361b5d31eef85513673a56741976cf94f190e704a361ee8df39c78527a295345680352d0b74dd75af502b3ad9b53ee10c52037d1f4fe4ec8b03355cda96e74f463e95ff16afd47481b357852279d541ad2602851f2663d6c707167c71a5e8d126bdfb082e53067186c8e28b3c606366e7a2e0b2d20cb1fb0ab3a12898e4fcce5b06d1df680fbcac61c35b9864d49c0ff57708ed4e35470692d5035b571e78e5868a04df9ce0c67191adadf92f618124c2c2347e3db9ac2011596688d6d29e8063569878096df0e3c30c906bafce32576589fce65ee5b1d4de9480fca940549d0300ac654ec2e044be4e2b70b8e3db294a0736c3620e900de8eaf3431bb54421228ec9de1f1d8e9baa2cdb101a30d379b35811e8ddef506faf2dd8d2c247371db0f3e438340c821b942844efbe96b2d82bea2d1f53a05897dae85649366846e4e85fa6b42bb18e243e43959d61dd44032b7aa1082d5f402d87f5bb5a56aeb2ce7fd69ee5ca3cb1e6093adc369e7bbff3dfeb627f6018f8f5f8932b43da1455f77d8a39af579fc5be4893ed21c1ec6ecf5b500417e33b8d97ce9011765b8d8ff7966da2754b157d4c190a4931cc6124f11a49dbbe4caa03921e69f36c0ef705b21af264f395881307a170dffd4b954777721002af278454761410569dbeef6e772a5b22cc722fc2d0efa5ab3906a756d36ce24f0c79c18b3d18a6ccb11dbe122a593212abf1782d7573fafa3d69d8b91cc369d077d90da3d2da19e9b5b0c77767f09b74d710d1127ea17de6b30c5fbd9ef409fde51312cc63831382da0bfb8a0b2657c8910d83b4876155cd7b564e062fe4aecb33c903ac9102429963dec640d774e14dbff7a2b076913d6d0ce1b397f1e78e46d92bd915912fd0cff3e933b0067415187de43d9ea84613cdf50919055259710748ef3c8c50c17de0b7c8b93bb50de15f2ab7b7a00f5b262533f020df2d1d98f2b1abbeec34532f76bae7a5425baf1551fa11431b8a5b00e52fdc626ded64fba546f047732dbb529978e24853927e43ef7abed430c6497fb8bb725aff63ee233870f1c93655a5f2f102577f9ced5d71b1dbfd40431ceab69ffc12aee2d4fc8da050559d983eceea83c10ff8591c736be1e9d5d9f176df6a859983f31edce1ed71d3bcd2b5e103327a8ff350ecc0af907f4cb803678ab1be844bcde724d4126d1b3a9f9d81ad625498e9309a6f28beae7cda4147af46bded52a3a4a240043f86ca2baf58126fa47a102f4428d158f5dbb68ad5bde4b9c974b07e9a9c0bdbf0a1246c2e4cc57990ac6cf46d4ffdedb1f025230a7d60ca94571b42850cbc572faef97c8a07d5380516807bd2a2ff5ef3bc8ebcee5da4e57f2f561536a79922370184b2131a49142d8644cf442269db779eaafcd6c605bbb1a8745b554107bee2826bd2a63c7c0f565af61448f24295c180a883867f054f5fff34cd737c70a727293ffe85f0d25176de12aef32860fdd7517135d8789549afaed7df66476fcb3c760b097e3a50059726083488f26a392804a9f4037fa3a586be7b71375a2449a2eeacf90e333070318e6fa1f9d0118e0635191cb2bd02f5a85c8202b1e9b722929f2655e7e51a7960a793137b1c0a309fb45ddb0cc1c6c3dd8b2d1c7f01c7c552e3b0d9ada22167cd5c5ecc7a14a73233b93221ffd2c426cf6e27c342637fd28c7d23fe36a70e730d3dcaea18d5e421487d6ee12f4a8e76656213622f7aa4e6dd4a85ba8603fec4b64f233f48e6be1d374f8f78efa1b29f37fb8b4dd84984b35c8ee79a396326c73992603d1480f615a041ad139a564bc7258b8ee635282f502ec442443262b3686ed6aa1c72b5c81fcc79234141918b2d625c0dff115115d5f97ca8718d5b9650ac4927ba17c9e9ee1f2be0c9ddaef099855fe17a8f8856486c6075abbd39d5599887b0c2f0c43781bb54ca9a3941502b26d17a7250dcb50e1ba6857eba5afbd1e03c2d920b1b062a8e74890c3fd96bf9d3e641271689f8ec1e11881abdb2a2ca06580b206d6bc26765d23068dd053cd31651981cb39ee8b99f5ef3d1cf7180268b6857586da19c3e8109576535e5fdcc506fe16f8c58da23a812a91e3941aa22e07591579b00c39ab293c56b686abdb83966bdbddb44c2aebe6bbbadc5a52b534b94efe89dc63736a381a1e2079a2dbb2e44e4f549c0e825c499be372b6f8e40dda5f761893477131cbd713091d7582287c4ebe0c40bd80f11512b365b9ab5a8a3b71b52117b3c8d6494798f478317480920a47d0b2f78dc607afe970649be56e47b643a7cc21e27c904e40c1ac2793548cd55244f617b5eaaeb53409b0ba2c7094", 0x1000}, {&(0x7f0000004300)="ac1da8c6f9cec6de74f94ab80b80b83d97ad642a0998df7368feef31fec1aca1970b310f0c8059b9a5168398871c9427a81b5754612db4eac1d756e5175f391fcc52ceeeea86ba69ec27728731d7b094224c42ecda76f3f5a505f5e63f3835c8b869979d805fda5d0000587ae1d92006952d6268e636d631d89d28b14982337d27276f667f09dab7089dbfab16368224c1d98b3b3d77fe899160d3af8e92f0ddb3de23093237aed71a9e5f3b2e11826dc2e1b546d9278073490ac0e61bb0424c772291f5e90ca1ae81e29ed943ef4e39ba62e890c5c2eb2e26e5", 0xda}], 0x9, &(0x7f00000044c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0x7}}, @rthdr_2292={{0x68, 0x29, 0x39, {0x1, 0xa, 0x0, 0x6, 0x0, [@private0, @mcast2, @private0={0xfc, 0x0, [], 0x1}, @local, @private2={0xfc, 0x2, [], 0x1}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x100}}, @pktinfo={{0x24, 0x29, 0x32, {@empty, r12}}}, @rthdr={{0x98, 0x29, 0x39, {0x4, 0x10, 0x0, 0x9, 0x0, [@private2={0xfc, 0x2, [], 0x1}, @private1={0xfc, 0x1, [], 0x1}, @private2={0xfc, 0x2, [], 0x1}, @local, @private0, @mcast1, @loopback, @local]}}}, @dstopts_2292={{0x30, 0x29, 0x4, {0x87, 0x2, [], [@hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x3e}}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0xa54}}], 0x1a0}}, {{&(0x7f0000004680)={0xa, 0x4e22, 0x6, @mcast1, 0x6}, 0x1c, &(0x7f0000004780)=[{&(0x7f00000046c0)="f74cebe9fcb163ec5d6d89fba4a5ee8b2fa9fb45c5e72d9471ade219711f94040d4a47f334aacbb9a52a28390fb40a8fb0e037b4b1bd2350216e691cc820de0558a64d845c03", 0x46}, {&(0x7f0000004740)="ddba860fb2bfb4f9946150bc0e32a28e550cee2d58", 0x15}], 0x2, &(0x7f00000047c0)=[@tclass={{0x14}}, @dstopts={{0x28, 0x29, 0x37, {0x3b, 0x1, [], [@padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x4a}]}}}, @hopopts={{0x30, 0x29, 0x36, {0x1, 0x3, [], [@pad1, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @pad1, @jumbo={0xc2, 0x4, 0x6}]}}}, @rthdrdstopts={{0x58, 0x29, 0x37, {0x0, 0x7, [], [@pad1, @calipso={0x7, 0x20, {0x0, 0x6, 0x6, 0xfff, [0x800, 0xffffffff, 0x8]}}, @ra={0x5, 0x2, 0x1ff}, @jumbo={0xc2, 0x4, 0x1}, @ra={0x5, 0x2, 0x2}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}}}, @rthdr_2292={{0x68, 0x29, 0x39, {0x11, 0xa, 0x2, 0x80, 0x0, [@dev={0xfe, 0x80, [], 0x36}, @mcast1, @rand_addr=' \x01\x00', @mcast1, @mcast1]}}}], 0x130}}], 0x5, 0x20000010) ioctl$TIOCL_GETMOUSEREPORTING(r1, 0x5412, &(0x7f00000000c0)=0x13) [ 1579.760050] kasan: CONFIG_KASAN_INLINE enabled [ 1579.765159] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 1579.779940] binder: 21103:21114 ioctl c0306201 20000280 returned -14 [ 1579.800877] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 1579.807132] CPU: 1 PID: 14521 Comm: kworker/u4:2 Not tainted 4.19.118-syzkaller #0 [ 1579.814829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1579.824191] Workqueue: events_unbound flush_to_ldisc [ 1579.829299] RIP: 0010:skb_put+0x2d/0x1c0 [ 1579.833359] Code: 56 41 55 41 54 41 89 f4 55 48 89 fd 4c 8d ad c8 00 00 00 53 e8 94 42 d0 fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 42 [ 1579.852251] RSP: 0018:ffff888048d5fb70 EFLAGS: 00010202 [ 1579.857595] RAX: dffffc0000000000 RBX: ffff888096b6c7c0 RCX: ffffffff851cadc4 [ 1579.864862] RDX: 0000000000000019 RSI: ffffffff8597670c RDI: 0000000000000000 [ 1579.872115] RBP: 0000000000000000 R08: ffff8880924fc140 R09: ffffed1015ce4733 [ 1579.879367] R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000001 [ 1579.886621] R13: 00000000000000c8 R14: ffff888096b6c8b8 R15: 0000000000000000 [ 1579.893875] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 1579.902095] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1579.907957] CR2: 00000000200000c0 CR3: 0000000087ec0000 CR4: 00000000001406e0 [ 1579.915212] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1579.922461] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1579.929716] Call Trace: [ 1579.932295] bcsp_recv+0x9f9/0x1420 [ 1579.935904] hci_uart_tty_receive+0x21d/0x520 [ 1579.940379] ? hci_uart_write_work+0x6f0/0x6f0 [ 1579.944945] tty_ldisc_receive_buf+0x14a/0x190 [ 1579.949518] tty_port_default_receive_buf+0x78/0xa0 [ 1579.954516] flush_to_ldisc+0x21d/0x390 22:13:59 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x6, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:13:59 executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x29, 0x87, &(0x7f0000000280)={0x41}, 0x10) 22:14:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) [ 1579.958488] process_one_work+0x91f/0x1640 [ 1579.962797] ? pwq_dec_nr_in_flight+0x310/0x310 [ 1579.967452] worker_thread+0x96/0xe20 [ 1579.971236] ? process_one_work+0x1640/0x1640 [ 1579.975710] kthread+0x34a/0x420 [ 1579.979056] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 1579.984583] ret_from_fork+0x24/0x30 [ 1579.988278] Modules linked in: 22:14:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1110882}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4040001) preadv(r1, &(0x7f00000017c0), 0x218, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x6, 0x2}, 0x8) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x40000041}, 0x10) r3 = syz_open_dev$vcsu(&(0x7f0000000000)='/dev/vcsu#\x00', 0x40, 0x84400) ioctl$SOUND_PCM_READ_RATE(r3, 0x80045002, &(0x7f0000000040)) syz_mount_image$minix(&(0x7f0000000140)='minix\x00', &(0x7f0000000380)='./file0\x00', 0xffffffffffff7fff, 0x0, &(0x7f0000000240), 0xaccaea8076f01662, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) mount(&(0x7f0000000240)=@filename='./file0\x00', &(0x7f00000002c0)='./file1\x00', &(0x7f0000000300)='fusectl\x00', 0x800842, &(0x7f0000000340)='wlan1!wlan0wlan1\x00') dup2(0xffffffffffffffff, r0) [ 1580.095047] ---[ end trace a71eb6c46fb5a501 ]--- [ 1580.096247] Bluetooth: Can't allocate mem for new packet [ 1580.099894] RIP: 0010:skb_put+0x2d/0x1c0 [ 1580.109442] Code: 56 41 55 41 54 41 89 f4 55 48 89 fd 4c 8d ad c8 00 00 00 53 e8 94 42 d0 fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 42 [ 1580.146821] RSP: 0018:ffff888048d5fb70 EFLAGS: 00010202 [ 1580.159963] RAX: dffffc0000000000 RBX: ffff888096b6c7c0 RCX: ffffffff851cadc4 [ 1580.179248] RDX: 0000000000000019 RSI: ffffffff8597670c RDI: 0000000000000000 [ 1580.190135] RBP: 0000000000000000 R08: ffff8880924fc140 R09: ffffed1015ce4733 [ 1580.200661] R10: ffffed1015ce4732 R11: ffff8880ae723993 R12: 0000000000000001 [ 1580.208503] R13: 00000000000000c8 R14: ffff888096b6c8b8 R15: 0000000000000000 [ 1580.216134] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 1580.225948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1580.231845] CR2: 000000000073cb94 CR3: 00000000863ba000 CR4: 00000000001406e0 [ 1580.239608] binder: BINDER_SET_CONTEXT_MGR already set [ 1580.239824] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1580.253358] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1580.260967] Kernel panic - not syncing: Fatal exception [ 1580.262652] binder: 21103:21108 ioctl 40046207 0 returned -16 [ 1580.267625] Kernel Offset: disabled [ 1580.277110] Rebooting in 86400 seconds..